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ABSTRACT 


A new category of crime has emerged in the border environment that is disrupting 
criminal typology. This new “hybrid” category intermixes physical and digital elements 
in ways not possible in the past. Internet technologies are facilitating this criminal 
evolution by affording perpetrators anonymity, efficiency, and distance. New criminal 
uses of the Internet have resulted in investigative challenges for law enforcement, 
especially concerning the illegal movement of people and goods. 

This thesis mapped the evolution of hybrid crime using cases from the Silk Road 
and Silk Road 2.0, viewed through the lenses of stigmergy and affordance theory. While 
the research identifies challenges for law enforcement, it also uncovers methods for 
countering hybrid crime. I found that while criminals are opportunistic in perceiving new 
affordances to commit crime, law enforcement can be equally capable of countering them 
by removing technological barriers. Law enforcement can break down these barriers by 
changing mindsets, implementing smart enforcement, and relying on expertise from 
public-private partnerships. 
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GLOSSARY OF TERMS 


Affordance Theory 

A framework for analyzing the relationship between an objeet and all possible aetions 
from that objeet. An affordance is the relationship between an object and the action. 
Some affordances are visible while others are only perceived. ^ 

Bitcoin 

A cryptocurrency that uses peer-to-peer transactions rather than a third party to process 
monetary transactions. Transactions are pseudo-anonymous, but recorded on a public 
ledger called a blockchain. Bitcoin was invented so transactions on the Internet could be 
“based on cryptographic proof instead of trust,” which allows for decentralized payments 
outside of financial institutions.^ 

Bitcoin Tumbler 

A third-party service used to mix transactions together from various sources as a way to 
make them more difficult to trace.^ Tumblers make it so the blockchain cannot be used to 
trace transactions between buyers and vendors.4 

BitTorrent 

An open-source protocol that allows for the transfer of large amounts of data through the 
Internet by segmenting the data into smaller pieces. BitTorrent transmits data “by 
breaking it into small chunks, sending it through a peer-to-peer network, and 
reassembling it.”5 

Darknet Marketplace (or Cryptomarket) 

A website hidden on the dark web that must be accessed through anonymizing software. 
Darknet marketplaces are used to sell illegal items such as drugs and guns. 


1 Don Norman, The Design of Everyday Things, rev. edition (New York: Basie Books, 2013), 10-13. 

^ Craig K. Elwell, M. Maureen Murphy, and Miehael V. Seitzinger, Bitcoin: Questions, Answers, and 
Analysis of Legal Issues, CRS Report No. R43339 (Washington, DC: Congressional Researeh Serviee, 
2015), 3. 

^ Ian Allison, “Biteoin Tumbler: The Business of Covering Traeks in the World of Cryptoeurreney 
Laundering,” International Business Times UK, February 13, 2015, http://www.ibtimes.eo.uk/biteoin- 
tumbler-business-eovering-traeks-world-eryptoeurreney-laundering-1487480. 

United States v. Ross William Ulbrieht, Sealed Complaint, l:13-eb-06919-KBF (SD NY, Oetober 2, 
2013), 15. 

^ Jessi Hempel, “The Inside Story of BitTorrent’s Bizarre Collapse,” Wired, June 19, 2017, 
https://www.wired.eom/2017/01/the-inside-story-of-bittorrents-bizarre-eollapse/. 
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Dark Web 


A segment of the deep web used by eriminal aetors and terrorists to intentionally eonceal 
illegal or subversive aetivities.^ 

Deep Web 

Everything on the Internet that is not indexed by traditional seareh engines and may be 
proteeted by speeial software or hidden behind password-protected accounts. The deep 
web is used for storage of large databases owned by the government, LexisNexis, and 
internal networks used by companies and academic institutions.^ 

Honeypot 

A method of enticing someone on the Internet to a specific site or part of a site for 
purposes of collecting information about motives and tactics.^ 

Media Dependency Theory 

A sociological theory that explains why people support social networks by proposing 
there exists “an internal link between media, audience and large social system.”9 The 
theory proposes that people and media have “a relationship in which the capacity of 
individuals to attain their goals is contingent upon the information resources of the media 

system. 10 

Moore’s Law 

An observation that has held true for the last fifty years that computing power will double 
every two years. H 

Stigmergy 

A concept meant to explain how agents, including human beings, achieve self¬ 
organization in decentralized group settings. 1^ 


0 Marc Goodman, Future Crimes: Everything is Connected, Everyone Is Vulnerable and What We Can 
Do about it, Kindle edition (New York: Anchor Books, 2015), 200-202. 

7 Ibid. 

^ William D. Eggers, Delivering on Digital: The Innovators and Technologies that Are Transforming 
Government, Kindle edition (New York: Rosetta Books, 2016), loc. 3327. 

^ “Media Dependency Theory,” Communication Theory, accessed November 18, 2017, 
http://communicationtheory.org/media-dependency-theory/. 

m Hsin-Yi Huang, Po-Lin Chen, and Yu-Chen Kuo, “Understanding the Facilitators and Inhibitors of 
Individual’s Social Network Site Usage,” Online Information Review 41, no. 1, (2017): 85. 

11 Robert L. Goldstone, Andy Jones, and Michael E. Roberts, “Group Path Formation,” IEEE 
Transactions on Systems, Man, and Cybernetics-Part A: Systems and Humans 36, no 3 (May 2006): 612. 

1^ Remi Pannequin and Andre Thomas, “Another Interpretation of Stigmergy for Product-Driven 
Systems Architecture,” Journal of Intelligence Manufacturing 23 (2012): 2589. 


XVI 



Sybil Attack 

An attack used to subvert eommunication flows in a peer-to-peer network by 
manipulating the assumed identities of relays. 

Tor 

Free software that operates on a distributed network meant to anonymize a user’s IP 
address, loeation, websites visited, and server loeations by bouneing eommunieations 
through several levels of eneryption keys using a random seleetion of nodes around the 

world. 

Traffic Confirmation Attack 

A computer attack that is done by controlling or observing entry and exit relays on both 
ends of a circuit to compare traffic timing, volume, or other characteristics so a 
determination can be made that the relays are on the same circuit. 15 

World Wide Web (or Surface Web) 

The part of the Internet that is indexed and accessible by traditional search engines. 


15 John R. Douceur, “The Sybil Attack,” Microsoft, accessed November 18, 2017, 
https://www.microsoft.eom/en-us/research/wp-content/uploads/2002/01/IPTPS2002.pdf 

14 “Tor: Overview,” The Tor Project, accessed November 18, 2017, https://www.torproject.org/ 
about/overview.html. en. 

15 “Tor Security Advisory: ‘Relay early’ Traffic Confirmation Attack,” Tor Blog, July 30, 2014, 
https://blog.torproject.org/tor-security-advisory-relay-early-traffic-confirmation-attack. 
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EXECUTIVE SUMMARY 


This thesis studies the ehanging typology of border-related erime being driven by 
Internet teehnologies. Internet teehnologies are moving elements of erime, understood to 
be physieal, to the digital realm. Drug traffieking, human trafficking, and sexual 
exploitation, and money laundering are some of the crimes being facilitated by Internet 
technologies. The evolution of crime is so dramatic that a new category, dubbed “hybrid” 
crime, has emerged and is creating challenges for law enforcement. The goal of this 
thesis is to identify the challenges of enforcing laws against the illegal movement of 
people and goods when that movement is facilitated by the Internet. 

Criminal use of the dark web. Tor, Bitcoin, and Bitcoin tumbler did not come 
about in a vacuum. Three pressures made the criminal environment ripe for 
transformative change. First, strong border enforcement made criminals search for new 
techniques that could facilitate crime. Second, new Internet technologies became 
available that could facilitate evolving physical criminal elements into digital elements. 
Third, as explained by media dependency theory, the criminal public transferred 
acceptance of online forums and social communities used on the Surface Web to darknet 
marketplaces, making the new technologies easy to accept. The result was the creation of 
hybrid crime. 

The incorporation of new technologies facilitating crime calls for unique methods 
of analysis. Affordance theory and the concept of stigmergy are two frameworks not 
typically used for the study of criminal justice, but that hold promise for analyzing hybrid 
crime. Affordance theory is a conceptual framework of analysis used predominantly for 
the study of design. 1 This theory looks to understand and analyze object-action 
relationships.2 For design theory, the intended purpose is to design products that function 
as perceived and desired; for the study of criminal justice, affordance theory can analyze 


1 Don Norman, The Design of Everyday Things, rev. edition (New York: Basie Books, 2013), 11. 

2 Ibid. 
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technology (the object) to determine possible actions (the affordance).^ This type of 
analysis can help investigators understand individual technologies, predict future criminal 
uses, and even recognize when a new category of crime emerges. Affordance theory is 
especially adaptive in dynamic environments like the world of crime and technology. 

Stigmergy complements affordance theory by explaining how decentralized 
groups with causal relationships self-organize even when they have no direct 
communication.^ Criminal justice and deviant behavior have a causal relationship; when 
one of them commits to an action, the other has a reaction. In particular, law enforcement 
and criminals are part of a stigmergic cycle in which enforcement of crime affects how 
criminals act and the type of criminal tactics employed influence law enforcement 
responses.5 When criminals use new methods, like Internet technologies, law 
enforcement must adapt by searching for new investigative techniques. The stigmergic 
cycle of law enforcement and crime dictates that a hybrid crime was created to overcome 
difficulties in committing border-related crimes using traditional means, but the starting 
point of the cycle is difficult to determine. This thesis uses affordance theory and the 
concept of stigmergy as a framework to analyze the Silk Road and Silk Road 2.0 darknet 
marketplaces. Both marketplaces provide ample information about the challenges 
involved with enforcing laws against the illegal movement of people and goods when that 
movement is facilitated by the Internet. 

The Silk Road investigation is the best-documented example of how a large-scale 
darknet marketplace was used to implement Internet affordances to create hybrid crime. 
Despite successfully identifying and arresting the operator, Ross William Ulbricht, and 
seizing the Silk Road website, there is no indication that law enforcement successfully 
overcame the criminal benefits brought about by Ulbricht’s Internet affordances. The 
dark web. Tor, Bitcoin, and Bitcoin tumbler all performed as Ulbricht had perceived to 
maintain anonymity. Instead of overcoming affordances, law enforcement was able to use 

^ Norman, The Design of Everyday Things, 4—12. 

4 Remi Pannequin and Andre Thomas, “Another Interpretation of Stigmergy for Produet-Driven 
Systems Arehitecture,” Journal of Intelligence Manufacturing 23 (2012): 2589. 

^ Rodrigo Nieto-Gomez, “Stigmergy at the Edge: Adversarial Stigmergy in the War on Drugs,” 
Cognitive Systems Research 38 (June 2016): 3-5. 
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traditional law enforcement and established cybercrime techniques to capitalize on the 
vulnerabilities created when Ulbricht converted a purely physical crime into a hybrid 
crime. Law enforcement successfully located digital shadows on the Surface Web that 
helped them identify Ulbricht. 

In contrast, the Silk Road 2.0 investigation shows law enforcement’s success 
using unconventional investigative methods to overcome anonymity afforded by Tor. The 
Silk Road 2.0 darknet criminal marketplace was created after the demise of the Silk 
Road. Two of the operators, Blake Benthah and Brian Farrell, took Ulbricht’s place after 
he was arrested.^ What is interesting for this study is that although Benthah and Farrell 
had a basis for believing in their Internet affordances, as Ulbricht did, law enforcement 
changed the game by overcoming the anonymity afforded by Tor. After investigating the 
Silk Road, law enforcement started perceiving certain Internet affordances differently and 
adapted to them. When dealing with hybrid crimes, they developed response techniques 
outside of traditional investigative methods. In essence, law enforcement found a way to 
alter previously understood object-action relationships among Tor, anonymity, and 
hybrid crime. By relying on non-law enforcement technological expertise from the 
Carnegie Mellon University’s Software Engineering Institute, law enforcement was able 
to overcome Tor anonymity and identify Silk Road 2.0’s operators.^ The Software 
Engineering Institute de-anonymized Tor by executing Sybil and traffic conhrmation 
attacks on the Tor network.^ This unconventional investigative technique is an example 
of law enforcement’s adaptability in response to hybrid crime. 

Criminals are continuing to rely on Internet technologies to commit border-related 
crime. This trend shows that drug trafficking has been proliferated by Internet 
technologies, but other crimes such as human trafficking and sexual exploitation and 


^United States v. Blake Benthall, Sealed Complaint, l:14-mj-02427-UA (SD NY, Oetober 29, 2014), 
8; United States v Brian Riehard Farrell, Complaint for Violation, 2:15-er-00029-RAJ (WD WA, January 
17, 2015), 7. 

^ United States v Brian Farrell, Order on Defendant’s Motion to Compel, CR15-029RAJ (WD WA, 
February 23, 2016), 1-2. 

^ “Tor Seeurity Advisory: ‘Relay early’ Traffie Confirmation Attaek,” Tor Blog, July 30, 2014, 
https://blog.torprojeet.org/tor-seeurity-advisory-relay-early-traffie-eonfirmation-attaek. 
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money laundering are also being influeneed. The reeent AlphaBay and Hansa darknet 
marketplaee eriminal eases show how prolifie Internet teehnologies are in the drug 
traffieking world.^ Several investigations involving live streaming from the Philippines 
highlight how Internet teehnologies are advaneing ehild exploitation erimes. The BTC-e 
money laundering investigation, in whieh eryptoeurreneies beeame the new tool for 
laundering illieit monies, demonstrates unique new ways of eommitting erime.lO These 
examples show a eontinuing upward trend in hybrid erime, or at a minimum, a trend of 
physieal erime elements eonverting to digital. 

This study identifies several ehallenges that law enforeement faees when 
enforeing against border-related erimes that are faeilitated by Internet teehnologies. To 
overeome enforeement ehallenges, this thesis found it essential to first properly label 
erime to determine effieient and effeetive investigative teehniques, and to faeilitate 
adequate analysis. Along with proper labeling, uneonventional analytieal frameworks, 
sueh as affordanee theory and stigmergy, will benefit the study of eriminal justiee and aid 
in analyzing hybrid erime. One of the most important reeommendations is to ehange 
mindsets about teehnology and erime through training. Law enforeement needs 
teehnology training and investigative support from teehnology experts. Onee training is 
aeeomplished, smart enforeement teehniques ean be employed that foeus on hybrid erime 
vulnerabilities and non-traditional enforeement teehniques that ean overeome eriminal 
affordanees. Smart enforeement measures need to be implemented that adapt to the 
dynamie environment of hybrid erime. Investigative teehniques need to be properly 
matehed to eriminal vulnerabilities for digital, rather than physieal, elements. Some 
teehniques more eompetently investigate physieal objeets, and others digital. A primary 


9 “AlphaBay, the Largest Online ‘Dark Market’ Shut Down,” Department of Justice, July 20, 2017, 
https://www.justice.gov/opa/pr/alphabay-largest-online-dark-market-shut-down; “Massive Blow to 
Criminal Dark Web Activities after Globally Coordinated Operation,” Europol, July 20, 2017, 
https://www.europol.europa.eu/newsroom/news/massive-blow-to-criminal-dark-web-activities-after- 
globally-coordinated-operation. 

“Russian National and Bitcoin Exchange Charged In 21-Count Indictment for Operating Alleged 
International Money Laundering Scheme and Allegedly Laundering Funds from Hack of Mt. Gox,” U.S. 
Department of Justice, July 26, 2017, https://www.justice.gov/usao-ndca/pr/russian-national-and-bitcoin- 
exchange-charged-21 -count-indictment-operating-alleged. 
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strategy of smart enforcement should include attacking the level of trust being given to 
darknet marketplaces as a way to achieve deterrence. 

This study found that criminals and law enforcement perceive Internet 
affordances differently, but that difference has not resulted in a large technology 
deficiency. Criminals use Internet technologies innovatively, but law enforcement is 
equally adaptive in its responses. Traditional investigative techniques have been effective 
against hybrid crimes when used at the time a criminal is transitioning physical elements 
to digital platforms. Unconventional methods that attack Internet affordances require 
more technical expertise to achieve, but have a greater impact against criminals. Despite 
the successes of traditional and unconventional methods, neither has effectively achieved 
general deterrence. 
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I. 


INTRODUCTION 


It was really hard explaining the Web before people just got used to it 
beeause they didn’t even have words like eliek and jump and page. 

—Timothy Berners-Lee, Inventor of the Internet^ 


A. PROBLEM STATEMENT 

Today, a child is being sexually victimized because someone used the dark web to 
produce, create the customer base for, and distribute child pornography.^ That criminal 
content will cross multiple international borders both as printed and online material. 
Today, a young girl is being bought and sold into prostitution, and criminals are using 
hidden online forums to make a sex trafficking transaction. She may then be trafficked to 
another country where she will be exploited. ^ Today, money laundering schemes are 
being facilitated by the electronic transfer of money through traditional United States 
banking institutions, through online purchases of stored value cards, or through virtual 
currencies. Those stored value cards or cash converted from virtual currency can then 
cross through international borders in the wallets of money launderers and drug dealers. 
Today, illegal immigration is facilitated by real identities, stolen from the Internet, that 
are used to make counterfeit documents. Heroin is being ordered online from a foreign 
country and shipped in plain sight to a U.S. customer through the U.S. Postal Service. 4 
Sensitive technology and intellectual property are being stolen and sold through Internet 
facilitation, and then smuggled out of the country.^ 


1 “Tim Bemers-Lee Quotes,” AZ Quotes, aeeessed Deeember 6, 2017, www.azquotes.eom/author/ 
8668-Tim_Bemers_Lee?p=5. 

^ Mare Goodman, Future Crimes: Everything is Connected, Everyone Is Vulnerable and What We Can 
Do about it, Kindle edition (New York: Anehor Books, 2015), 260, 262-263. 

3 Ibid., 261. 

4 Ibid., 256. 

3 Cyber War: Definitions, Deterrence, and Foreign Policy, Hearing before the Committee on Foreign 
Affairs to the Committee on Foreign Affairs, 114 Cong., I sess. (September 30, 2015), 7. 
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These are examples of erimes that use “Internet affordances” to eireumvent law 
enforcement techniques deployed around national borders to avoid detection. In design 
studies, an affordance is defined as “a relationship between the properties of an object 
and the capabilities of the agent that determine just how the object could possibly be 
used. ”6 Strategic management studies discuss affordance combined with technology, 
wherein “the use depends not only on the material properties or on the intended design of 
the tool, but also on the context and the interpretations of actors who may use the 
technologies in creative, unpredictable ways.”^ Internet affordances have lessened the 
effectiveness of border security techniques, for which enforcement strategies do not plan 
for an Internet component. 

Cyberattacks and cyber intrusions are obvious direct risks from the Internet, but 
less obvious risks are initiated by actors who use the Internet to facilitate crimes 
traditionally only committed in the physical world. The Internet has provided these actors 
with a new means of committing criminal activity that is hidden from the physical world 
and often more difficult to identify. When law enforcement efforts are aimed at border 
security in the physical world, a person or good can easily be examined or inspected to 
determine criminal activity; this is not possible for crimes that cross a digital border. The 
investigative tools for examining or inspecting people or goods are less effective or 
completely impossible when transnational crimes are facilitated by the Internet. 

To expand on the previous examples: child pornography can be electronically sent 
in or out of the United States without any physical object crossing the border; money 
laundering schemes can be completely virtual and will remain so until electronic funds 
are converted into currency; stolen sensitive technology or intellectual property does not 
ever need to be converted outside of the virtual world if it involves electronic data, plans, 
or digital media. Even though these Internet-facilitated crimes do not cross a physical 
border, they cause the same amount of harm to the physical world. These crimes fit well 
within the overarching category of cybercrimes, but others do not. 

^ Don Norman, The Design of Everyday Things, rev. edition (New York: Basie Books, 2013), 11. 

^ Paula Jarzabkowski and Sarah Kaplan, “Strategy Tools-In-Use: A Framework for Understanding 
‘Teehnologies of Rationality’ in Praetiee,” Strategic Management Journal 36 (Mareh 2014): 539. 
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Drug trafficking, sex trafficking and sexual exploitation, and smuggling of bulk 
cash or stored value cards have a hybrid nature that allows them to affect both physical 
and digital borders. Sex trafficking is frequently facilitated by the Internet, which is used 
to entice victims and house hidden forums that advertise and “sell” the product of sex. 
Human trafficking relies on Internet facilitation to locate potential clients and collect 
fees. Drug trafficking can rely on individual buyers who order and pay for drugs 
completely online without ever visiting a “dark corner” or interacting face-to-face with a 
drug dealer. Illegal transfers of money can occur when someone transfers money 
electronically or adds value to stored value cards on the Internet. This is one way to 
launder proceeds of crime. Although these crimes are afforded by digital technologies, 
they do not neatly fit the definition of cybercrimes because they still depend on a 
physical, trans-border aspect. Sex and human trafficking victims must physically cross 
the border for the crime to occur. Drug traffickers, even if filling orders online, must still 
physically ship drugs across the border into the United States, often using the U.S. Postal 
Service for the illegal transaction. Bulk cash and stored value cards can begin as Internet- 
facilitated electronic transfers that are then withdrawn as physical currency so cash and 
cards can be smuggled across the U.S. border to avoid banking laws. 

The Department of Homeland Security has primary responsibility for enforcement 
of border-related crimes, but it has no policy to specifically address the intersection of 
border enforcement and the Internet on the transnational scale—the United States does 
not build border security strategies with Internet-enabled threats in mind. Law 
enforcement currently has limited tools to effectively combat transnational crimes with 
online components and is not advancing investigative techniques as quickly as criminal 
actors are advancing their use of technology. Because the United States’ border 
enforcement is almost blind on the Internet, a technology gap is believed to be growing 
between criminal actors and law enforcement. This technology gap continues to grow 
wider as organizational and cultural constraints limit law enforcement’s ability to adapt. 

A physical wall will not affect the Internet-based elements of transnational crime 
involving the illegal movement of people and goods in and out of the United States, but 
removing barriers that keep law enforcement from understanding technology will. The 
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Internet ereates affordanees that faeilitate innovative ways of committing old and new 
crimes.^ Understanding how those affordanees work is a critical component of this thesis. 
If successful, this research will facilitate a more effective border security strategy and law 
enforcement techniques that are better able to enforce laws aimed at the illegal movement 
of people and goods facilitated by the Internet. 

B. RESEARCH QUESTION 

This thesis answers the question; What are the challenges of enforcing laws 
against the illegal movement of people and goods when that movement is facilitated by 
the Internet? 

C. LITERATURE REVIEW 

Internet technologies, criminal typologies, and border enforcement are diverse 
and complicated subject areas. This literature review summarizes material relevant to 
applicable topics, including Internet trends, the criminal environment, theoretical 
frameworks, technology, and cases involving darknet markets. Because this study 
involves disruptive technologies, contemporary criminal cases, and future studies, it was 
difficult to locate material on some of the important sub-topics. As a result, the review 
covers non-academic articles and media reports, in addition to scholarly journal articles, 
published books, and court documents. 

I. Internet Complexity Defined by Cybercrime and Intrusions 

To recognize the differing Internet affordanees available to criminals and law 
enforcement, it is first necessary to understand how the Internet is used to facilitate 
crimes. There is significantly more material that addresses the complexity of Internet- 
facilitated cybercrimes and intrusions than border-related crimes. Even though most 
material about complexity does not directly involve border-related crimes, Internet 
complexity involving any criminal activity is valuable to understanding others. This 


^ Daniel Robey, Chad Anderson, and Benoit Raymond, “Information Technology, Materiality, and 
Organizational Change: A Professional Odyssey,” Journal of the Association for Information Systems 14, 
no. 7 (July 2013): 386-389. 
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section of the literature review shows how the Internet’s complexity is reflected in the 
literature through pervasiveness of crime, lack of definitional consensus, and 
explanations of dark web disruptive technology. 

Published books, government testimony, journal articles, and media reports were 
the primary sources reviewed to understand the complexity of cybercrimes and 
intrusions. A large amount of literature confirms the pervasiveness of cyberattacks and 
intrusions. The material consistently uses case studies to explain the severity of the 
problem and to associated costs. For example, Goodman explains that losses from the 
2007 TJX hacker attack resulted in the theft of ninety-four million customer credit card 
details, with a true cost of over $1 billion.^ He also notes that an estimated $400 billion is 
lost globally each year to cybercrime. Riley, Elgin, Lawrence, and Matlack analyze a 
2013 malware attack against Target department stores that resulted in 70 million stolen 
credit card and debit card account credentials, costing in excess of $1 billion. Elkind 
discusses the 2014 Sony Pictures Entertainment cyberattack, during which sensitive data 
was stolen and half of Sony’s network erased.l^ This literature demonstrates a pervasive 
cyberattack pattern and shows that criminal actors have Internet affordances that law 
enforcement do not, and that law enforcement has not been capable of deterring criminal 
behavior away from the Internet. 

The complexity is especially apparent when one attempts to define the actions that 
make up cybercrime, cyberterrorism, and cyberwar. Holt discusses the problems of 
defining cybercrime and cyberterrorism and expounds on scholarly disagreements about 
whether cybercrime should be viewed as simply a traditional offense using new tools, or 
a new, unique form of offense. 1^ Compounding the problem, Bryant explains that every 

^ Goodman, Future Crimes, 22. 

10 Ibid., 465. 

11 Michael Riley et at, “Missed Alarms and 40 Million Stolen Credit Card Numbers: How Target 
Blew it,” Bloomberg, March 13, 2014, www.bloomberg.eom/news/articles/2014-03-13/target-missed- 
wamings-in-epic-hack-of-credit-card-data. 

1^ Peter Elkind, “Sony Pictures: Inside the Hack of the Century,” Fortune, June 25, 2015, 
http://fortune.com/sony-hack-part-l/. 

1^ Thomas J. Holt, “Exploring the Intersection of Technology, Crime, and Terror,” Terrorism and 
Political Violence 24, no. 2 (March 14, 2012): 338-340. 
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law enforcement agency defines cybercrime based on its own unique authorities. 14 While 
Jarvis, MacDonald, and Nouri write about debate and disagreement surrounding 
cyberterrorism, Demchak writes about similar lack of consensus concerning the concept 
and definition of cyberwar. 1^ Divergent ideas, exemplified by absent definitional 
consensus, can create wasted law enforcement effort, the costs of which are substantial, 
though often unrecognized. 

The dark web’s complexity is evident in literature that describes its anonymous 
and disruptive nature. While White explains how the Defense Advanced Research 
Projects Agency (DARPA) is trying to achieve Internet affordances to curb human 
trafficking facilitated by the dark web, Goodman explains how criminals are better than 
most people at adapting to new technologies because they are used to committing crimes 
in an environment that is constantly in flux.l^ Criminals are using the dark web to 
facilitate both cybercrime and border-related crimes, such as drug trafficking. Goodman 
and Maras do a thorough job of explaining how drug trafficking occurred on the Silk 
Road, an online criminal marketplace in the dark web where drug consumers could order 
any type of drug through the Internet. According to Maras, the site even provided 
advice on how not to get caught by advising dealers to avoid shipping orders directly to 
an individual’s residence. Goodman and Maras explain how drugs can be ordered, sold, 
and shipped anywhere in the world due to the dark web’s interconnectivity. This 
background is important because it exemplifies how the Internet is now facilitating 
border-related crimes: drugs can be ordered online from anywhere in the world, but still 
must physically cross U.S. borders to get to consumers. 


14 Robin Bryant and Sarah Bryant, Policing Digital Crime (Burlington, VT: Ashgate, 2014), 26, 38. 

1^ Lee Jarvis, Stuart MaeDonald, and Leila Nouri, “The Cyberterrorism Threat: Findings from a 
Survey of Researehers,” Studies in Conflict & Terrorism 37 (September 2013); As eited in Derek S. 
Reveron, Cyberspace and National Security: Threats, Opportunities, and Power in a Virtual World 
(Washington, DC: Georgetown University Press, 2012), 98, 122-128. 

1^ “Christopher White: Fighting the ‘Dark Web,’” YouTube video, 14:16, from a TedxTalk on the 
Oklahoma State University eampus on April 10, 2015, posted by TEDxTalks, April 30, 2015, 
https://www.youtube.eom/wateh?v=9QsjkJeUznA; Goodman, Future Crimes, 229-231. 

1^ Goodman, Future Crimes, 245-250; Marie-Helen Maras, “Inside Darknet: The Takedown of Silk 
Road,” CriminalJustice Matters 98, no.l (Deeember 2014), doi:10.1080/09627251.2014.984541. 
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2. 


Border Crimes and Internet Use 


Published books, government testimony, and journal artieles mostly address 
physieal aspeets of border erimes; there is far less material deseribing how these erimes 
are faeilitated by the Internet. Experts eite multiple reasons for border-related erime, 
including increased illegal immigration resulting from past immigration policies, the 
United States’ propensity for involvement in various forms of smuggling, and global 
economics. This review also reveals divergent findings about how the Internet facilitates 
border-related crimes and whether new technologies negatively impact enforcement. 

Andreas’ research details the history of increasing border enforcement, and how 
U.S. policies that seek to deter the illegal movement of people and goods have impacted 
smuggling. 18 Specifically, he explains how U.S. enforcement strategies have changed 
regarding the smuggling of drugs and undocumented immigrants from Mexico. Andreas 
does not agree with political rhetoric that declares the United States has lost control of the 
border in order to gain political support for greater policing; rather, he believes the 
United States has never had control of the border. He provides a historical context of 
smuggling and explains that, by policing the border more, the United States is only 
heightening the smuggling problem. 

Massey, Durand, and Pren corroborate Andreas’ claim that increasingly stringent 
border enforcement policy decisions have negatively impacted undocumented 
immigration. The authors assert that human smuggling, and dramatic increases of 
Mexican undocumented immigrants remaining in the United States, are a result of 
increased border enforcement. 19 This literature explains how human smuggling across 
the U.S.-Mexico border became a lucrative crime because of immigration policy 
decisions. The increased border policing moved undocumented immigrant crossings 
away from easy, established paths to more difficult crossing areas. As an unintended 
consequence, travelers began hiring human smuggling organizations to help them 

18 Peter Andreas, Border Games: Policing the U.S.-Mexico Divide, 2nd edition, Kindle (Ithaea, NY: 
Cornell University Press, 2009). 

19 Douglas S. Massey, Jorge Durand, and Karen A. Pren, “Why Border Enforeement Baekfired,” 
American Journal of Sociology 121, no. 5 (March 2016): 1590. 
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traverse the more diffieult terrain, thereby inereasing illegal immigration eosts, whieh 
eaused people to stop returning to Mexico.^0 

In addition to providing historical evidence of drug smuggling, the literature also 
identifies the Internet as a means to smuggle items like intellectual property and 
pornography. As Andreas explains, the Internet is just another method, like car trunks and 
luggage.21 Of particular value for this research, Andreas states that “most smuggling 
parallels the methods and routes of legal commerce,” even when employing the 
Intemet.22 More recently, Andreas explains how globalization and technology have made 
both legal and illicit transactions easier and less costly.23 He explains how border crimes 
all have some basis in smuggling, and shows how the United States has been historically 
reliant on smuggling. Border-related crimes are connected to the smuggling of prohibited 
commodities; legal commodities that wish to avoid sanctions, taxes, or tariffs; stolen or 
counterfeit commodities; people; and endangered species. Andreas discusses how new 
technologies such as the Internet have aided criminal activity, but he also asserts that 
those same technologies have aided enforcement: “We greatly understate the degree to 
which the same technological transformations that have facilitated the globalization of 
crime also facilitate the globalization of crime control.”24 

Finklea further discusses the Internet and discusses how cyberspace interacts with 
border security.25 She explains how criminal activity is becoming as borderless as 
legitimate business, through globalization and interstate commerce. Her article discusses 
the difficulty of maintaining a border in the virtual world and identifies crimes, such as 


20 Massey, Durand, and Pren, “Why Border Enforeement Baekfired,” 1590. 

21 Peter Andreas, Border Games, 521. 

22 Ibid. 

23 Peter Andreas, Smuggler Nation: How Illicit Trade Made America, Kindle edition (New York: 
Oxford University Press, 2013), 331-332. 

24 Ibid., 341-345. 

25 Kristin M. Finklea, “The Interplay of Borders, Turf, Cyberspaee, and Jurisdietion: Issues 
Confronting U.S. Law Enforeement,” Journal of Current Issues in Crime, Law and Law Enforcement 5, no 
1/2 (February 2012): 29-67. 
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fraud and identity theft, that are being re-eategorized as non-traditional (rather than 
traditional) eybererimes. 

3. Affordance Theory, Affordances, and Crime 

Affordance theory has been used to explain human aetions in the fields of 
ecological psychology, sociology, strategy, law, and human-computer design. The 
literature recognizes James Gibson as the architect of affordance theory; he was 
purportedly the first to write about the concept of affordances, for the field of ecological 
psychology. Gibson defines affordances as “the complementarity of the animal and the 
environment.”26 He explains that affordances relate to all of an individual’s action 
possibilities, whether recognized or not, and that humans interpret cues from the 
environment to determine how to interact with objects.22 

Norman builds upon Gibson’s work by using affordance theory in the study of 
human-computer interactions. Norman also builds on Gibson’s study of perception by 
developing the term “perceived affordance.”28 He describes perceived affordance as the 
interaction perceived to be most likely between a human and another object, such as a 
computer, based on past experiences. Norman’s writings are the basis for identifying and 
understanding affordances in design theory, and a large amount of literature about design 
theory supports Norman’s work. 

Robey, Anderson, and Raymond expound on Norman’s use of affordances for 
design theory, explaining it is intended to direct technology designers to make uses of 
technology obvious: “The affordance relationship exists as long as action possibilities are 
perceivable, but the relationship remains even when we do not focus on action 
possibilities.”29 Despite the relevance of Norman’s work—which goes a long way to 
illuminate why people use the Internet for different purposes—the most valuable 

26 James J. Gibson, The Ecological Approach to Visual Perception (Boston: Houghton Mifflin, 1979), 
127. 

22 Norman, The Design of Everyday Things, 12. 

28 “Affordances and Design,” Nielsen Norman Group, accessed February 19, 2017, www.jnd.org/ 
dn.mss/affordancesand.html. 

29 Robey, Anderson, and Raymond, “Information Technology,” 387. 
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affordance definition, at least in terms of understanding eriminal affordanees, eomes from 
literature about strategy tools. In diseussing strategy tools, Jarzabkowski and Kaplan 
explain that affordanees’ “use depends not only on the material properties or on the 
intended design of the tool, but also on the eontext and the interpretations of actors who 
may use the technologies in creative, unpredictable ways.”30 This is significant because it 
posits that everyone will perceive and possess different affordanees, depending on the 
person’s unique relationship to the object. 

Use of affordance theory for human-computer design should prove valuable for 
analyzing Internet-facilitated crimes, but the literature on affordance theory specific to 
criminal justice, especially border-related crimes, is limited. One study by Gill, Conway, 
Thornton, Bloom, and Morgan uses affordance theory to study criminal use of the Internet 
by terrorists. Although their research concludes that the Internet provides affordanees to 
terrorists, it does not determine whether Internet or physical-world experiences create 
more radicalization.31 Of most significance is the finding that potential terrorist plotters 
rely on a hybrid approach of Internet use and physical-world encounters for 
radicalization. It is this hybrid nature—Internet use combined with physical-world 
elements—that is central to this thesis. 

4. Stigmergy 

Stigmergy is a concept that has been used by various disciplines to explain how 
agents achieve self-organization in decentralized group settings.32 Zoologist Pierre-Paul 
Grasse first introduced the concept to explain how termite colonies self-organize.33 
Various researchers have more recently used the concept to explain human and computer 
behavior, and material production. When describing the creation of product-driven 
systems architecture, Pannequin and Thomas write, “The key point of stigmergy is that 

31* Jarzabkowski and Kaplan, “Strategy Tools-In-Use,” 539. 

31 Paul Gill et al., “Terrorist Use of the Internet by the Numbers: Quantifying Behaviors, Patterns, and 
Proeesses,” Criminology & Public Policy 16, no. 1 (2017): 99-117. 

32 Remi Pannequin and Andre Thomas, “Another Interpretation of Stigmergy for Product-Driven 
Systems Architecture,” Journal of Intelligence Manufacturing 23 (2012): 2589. 

33 Ibid. 
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there is no direet communieation between aetors, only indireet eommunications through 
cues deposited on the environment.”34 Goldstone, Jones, and Roberts rely on stigmergy 
to explain how group behavior from earlier actions influences subsequent actions through 
the formation of pathways.They note that stigmergy is valuable because it can relate 
the study of pathway formation from purely physical to abstract analysis. Privat combines 
the concept of stigmergy with phenotropics to explain self-configuration of embedded 
systems.36 His journal article discusses how decentralized systems, including computers 
and robotics, can interlink actions stigmergically and form self-communication from 
sensor and human stimuli. While this literature shows stigmergy is adaptable to various 
disciplines and can be used to explain self-organization of various groups, it does not 
demonstrate use for the study of crime. 

The only specific study of crime as it relates to stigmergy is a journal article by 
Nieto-Gomez, which explores the resilience of the illegal drug supply chain.37 He 
explains how U.S. law enforcement actions are influencing drug traffickers to devise new 
and better drug-smuggling methods, resulting in a resilient supply chain. In making his 
argument, Nieto-Gomez describes drug trafficking at the U.S.-Mexico border as a self¬ 
organizing environment, and government and criminal agents as the influencing 
decentralized groups. An important part of his argument is the explanation that the 
stigmergic relationship allows both decentralized groups to send and receive stimuli; it is 
an iterative process in which groups both act and react to one another. 3 8 This literature is 
directly applicable to the study of border-related crime, causal relationships, and 
innovative technologies. 


34 Pannequin and Thomas, “Stigmergy for Product-Driven Systems Architecture,” 2587-2599. 

33 Robert L. Goldstone, Andy Jones, and Michael E. Roberts, “Group Path Formation,” IEEE 
Transactions on Systems, Man, and Cybernetics-Part A: Systems and Humans 36, no 3 (May 2006): 

36 Gilles Privat, “Phenotropic and Stigmergic Webs: The New Reach of Networks,” Universal Access 
in the Information Society 11, no. 3 (2012): 323-335. 

3^ Nieto-Gomez, “Stigmergy at the Edge,” 31-40. 

38 Ibid. 
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5. 


The Silk Road and Silk Road 2.0 


The Silk Road and Silk Road 2.0 were two darknet marketplaces that used 
Internet technologies to facilitate the smuggling of illegal drugs into the United States. 
Two books, written by Goodman and Bilton, contain particularly valuable information 
about the Silk Road. While Goodman’s material focuses on the Silk Road’s technologies 
and criminal activities, Bilton provides a more personal description of the Silk Road 
operator and criminal investigation.39 Goodman explains how the dark web. Tor, and 
other technologies were used to facilitate criminals who used the Silk Road to smuggle 
such items as drugs, guns, and stolen credit cards.^O Bilton’s material explains that the 
operator created the Silk Road based on libertarian ideals, and maps the thought process 
for how technologies were selected.^l In addition to Bilton’s literature, court documents 
provide the most information about the criminal activities and law enforcement 
techniques used to gather evidence. 

A search for research about Silk Road 2.0 resulted in less literature. The primary 
Silk Road 2.0 reference material comes from court documents and online articles and 
forums. Court documents for the criminal case against operator Blake Benthall explain 
that Silk Road 2.0 relied on the same Internet technologies as the Silk Road.42 Court 
documents also show how the arrest of the original Silk Road operator impacted 
perceptions of Silk Road 2.0.43 Court documents for the criminal case against Brian 
Farrell, the second Silk Road 2.0 operator, provide similar material; additionally, an order 
written by Judge Richard A. Jones discloses how law enforcement received help 
overcoming Tor anonymity from Carnegie Mellon University’s (CMU) Software 
Engineering Institute (SEI).44 This literature is valuable for understanding how 

39 Goodman, Future Crimes, 194-200; Nick Bilton, American Kingpin: The Epic Hunt for the 
Criminal Mastermind Behind the Silk Road (New York: Portfolio/Penguin, 2017). 

40 Goodman, Future Crimes, 245. 

41 Bilton, American Kingpin, 33-46. 

42 United States v. Blake Benthall, Sealed Complaint, l:14-mj-02427-UA (SD NY, October 29, 2014). 

43 Ibid. 

44 United States v. Brian Farrell, Order on Defendant’s Motion to Compel, CR15-029RAJ, (WD WA, 
February 23, 2016.) 
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technologies were used for Silk Road 2.0 and law enforcement’s corresponding 
adaptation of investigative techniques. 

The vast majority of the literature found for this study is relevant, comprehensive, 
and scholarly. The material about affordance theory helps establish an analytical 
framework unique to the study of crime. When this material is combined with stigmergy 
literature, a true understanding of the dynamic environment created by crime and law 
enforcement is achieved. Material about the Silk Road and Silk Road 2.0 is especially 
valuable for mapping the criminal evolution of hybrid crime and showing law 
enforcement’s corresponding adaptability. When combined, the literature provides a clear 
picture of how technology in the criminal environment creates challenges for law 
enforcement. 

D. RESEARCH DESIGN 

This thesis analyzes the criminal issue of border crimes facilitated by the Internet, 
using the Silk Road and Silk Road 2.0 as case studies. I chose the Silk Road and Silk 
Road 2.0 because both examples have a border nexus, they facilitated crime using 
Internet technologies, and they maintained both physical and digital criminal elements. 
This hybrid nature does not allow for neat categorization into physical or cybercrime 
subsets; I believe this explains why law enforcement was initially unable to detect or 
respond to newly perceived Internet affordances. The realization that the hybrid nature of 
certain crimes creates difficulties for criminal typology and response became a central 
part of this research. 

After identifying and selecting these two cases, I gathered pertinent data on how 
criminal actors traditionally commit border-related crimes; the investigative techniques 
law enforcement traditionally employs; how the criminal actors in these examples used 
the Internet to commit the criminal activity; how law enforcement identified the criminal 
activity facilitated by the Internet; what law enforcement did to overcome the criminals’ 
Internet affordances; and the traditional or new investigative techniques used to gather 
evidence. I analyzed the resulting data using affordance theory and the concept of 
stigmergy as frameworks. 


13 



In doing so, my intention was to identify the differing Internet affordanees 
between eriminal aetors and law enforeement pertaining to drug traffieking, human 
traffieking and sexual exploitation, and money laundering. I also initially believed that a 
wide teehnology gap exists between eriminals and law enforeement whieh does not allow 
for general eriminal deterrenee, even when eriminal investigations lead to arrests. When 
arrests are made for erimes faeilitated by the Internet using only traditional law 
enforeement teehniques, rather than narrowing the teehnology gap by realizing eriminal 
Internet affordanees, it allows eriminals to believe eriminal methods are still effeetive. If 
eriminals still believe the Internet ean faeilitate future erimes, any arrest made will only 
be a specifie, as opposed to a general, deterrenee. I therefore believed that general 
deterrenee is not possible without eliminating the teehnology gap between law 
enforeement and eriminals. 

The actual output of the research, however, was a mixture of validation, 
invalidation, and inconclusiveness. I did find that criminals and law enforcement realize 
different Internet affordanees in their perception of border-related crime. However, 
contrary to my initial belief, and despite validating that criminals and law enforcement 
have different Internet affordanees, I found that a wide technology gap does not exist. 
Finally, the output relative to deterrence was inconclusive. I found that traditional and 
unconventional investigative techniques were both effective at achieving specific 
deterrence, but neither has achieved general deterrence. 
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II. THE INTRODUCTION OF A HYBRID CRIME 


The value of a well-designed object is when it has such a rich set of 
affordances that users can do things with it that the designer never 
imagined. 

—Donald Norman^^ 


In 1859, Charles Darwin opened people’s eyes to the concept of evolution when 
he published the book On the Origin of Species by Means of Natural SelectionA^ 
According to George Levine, Darwin theorized that organisms’ “perpetuation through 
heritability is largely determined by their usefulness in adapting the organism to its 
environment. ”47 As part of his explanation of evolution, Darwin discusses the 
hybridization of organisms and difficulties in predicting hybrid organism sterility and 
fertilization.48 While Darwin’s research focuses on understanding changes to living 
organisms, evolution and hybridization can also be used to explain many non-biological 
changes in society, including crime. Crime and deviant behavior are social constructs that 
continually adapt to the environment and evolve. Similar to biological organisms, crime 
can hybridize as part of an adaptive survival process. Recently, cross-border crimes have 
adapted to environmental pressures and evolved; while they were once traditional, 
physical crimes, they now contain both physical and digital elements. Evolution has bred 
a new hybrid crime category that has changed the typology of crime. 

Advancements in Internet technologies have made cross-border hybrid crimes 
possible.49 While criminal transformation might be seen as a natural social evolution of 

45 “Models and Theories in Human-Computer Interaetion/Norman’s Affordanees-Visibility and the 7 
Stages of Aetion,” WikiBooks, aeeessed Deeember 6, 2017, https://en.wikibooks.org/wiki/Models_and_ 
Theories_in_Human-Computer_Interaetion/Norman%27s_Affordanees_-_Visibihty_and_the_7_Stages_ 
ofAetion. 

46 Charles Darwin, The Origin of Species by Means of Natural Selection (Annotated), Kindle edition 
(G. Books, 2011), 82. 

47 Darwin, Introduetion, 442. 

48 Darwin, Chapter VIII, 108-115. 

49 Finklea, “The Interplay of Borders,” 29. 
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deviant behavior, Internet teehnologies have introdueed a “game-ehanging” adaptation. 
They have dramatieally disrupted the understanding of eriminal aetivity and foreed law 
enforeement into a realm normally oeeupied by teehnology experts. Understanding 
hybrid erimes requires a new mindset and new theories of evaluation. Further, 
preventing, disrupting, and proseeuting these hybrid erimes requires new investigative 
tools based on speeialized teehnieal expertise. This ehapter identities the pressures that 
eaused hybrid erime to form, uses the eoneept of stigmergy to explain the dynamie 
relationship between eriminal aetivities and law enforeement aetions, and proposes 
affordanee theory as an uneonventional method for analyzing eriminal transformations 
faeilitated by Internet teehnologies. 

A. WHAT IS HYBRID CRIME? 

Drug traffieking, human traffieking/sexual exploitation, and money laundering are 
eross-border erimes that have evolved to inelude physieal and digital elements. Border- 
related smuggling may be eommitted using various means and methods. Traditional 
methods rely on the physieal movement of goods or people, eash payments, and in- 
person meetings. Some smuggling still relies exelusively on physieal objeets and physieal 
aetions, but now other methods exist in the digital realm. Cross-border erimes may still 
be purely physieal or purely digital, but the ones that are being viewed for this study are a 
hybridization of the two. The hybrid nature of these erimes does not result in a new 
erime, but in a new eategory of erime and ehanged eriminal typology. 

For purposes of this study, I define a hybrid erime as one that relies on both 
physieal and digital elements, and eaeh element has to fulfill a eritieal part of the aetivity 
to aeeomplish the overall erime. One way to better understand how the new hybrid 
eategory impaets eriminal typology is by eomparing different eategories of erime. The 
following hypothetieal examples demonstrate different eategories of erime for smuggling 
ehild pornography through a U.S. international airport. 

(1) Physieal Crime Category 

A person ean smuggle hard-eopy images of ehild pornography into the United 

States by eoneealing them in a suitease. In this example, law enforeement ean loeate the 
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illegal contraband using the traditional physical technique: inspecting the suitcase. From 
this physical action, law enforcement can identify that a crime has been committed. In 
this purely physical crime, the object is physical, and the action of crossing the border 
with concealed illegal contraband is also physical. 

(2) Digital Crime Category 

A person outside the country can use the Internet to “smuggle”—through file 
sharing—digital images of child pornography to someone in the United States. The 
images are never printed and remain digital. If law enforcement had information that 
illegal contraband was being smuggled through a particular email account, they could 
obtain an email search warrant. From this warrant, officers could identify that a crime is 
being committed; then, if the criminal travels to the United States, he could be arrested. 
This is a cybercrime because the object is digital, and the action of sending the digital 
object through the Internet is also digital. 

(3) Hybrid Crime Category 

A person can smuggle digital images of child pornography into the United States 
by downloading them from the Internet while in a foreign country, and then transporting 
the saved digital images across the U.S. border on a laptop or mobile telephone. In this 
instance, law enforcement can locate the illegal contraband using the traditional 
cybercrime technique: creating an image of the laptop and telephone to inspect the 
devices, thus exposing the crime. This is a hybrid crime because the object is digital 
while the action of crossing the border with illegal contraband is physical. 

(4) Undetermined Crime Category 

A person can “smuggle” digital images of child pornography into the United 
States that are saved electronically in a cloud-based file-sharing service such as Dropbox 
or IDrive. Law enforcement could create an image of the laptop and telephone to inspect 
for illegal contraband; however, in this example, law enforcement might not be able to 
identify the images or even the file-sharing account. The traditional law enforcement 
technique (physical inspection) or cybercrime technique (imaging devices) would not 
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identify the illegal eontraband. The erime eould be eategorized as a eybererime if the 
images are downloaded from the Dropbox or IDrive, thus rendering them into a digital 
format. It eould also be eategorized as a hybrid erime because the accounts or images are 
saved digitally, albeit in the cloud, and the person is physically entering the United 
States. The complication with labeling this example crime is that even though the person 
is physically entering the United States, the images are not being physically or digitally 
smuggled until they are downloaded from the cloud. This example crime is difficult to 
classify because the actions and the objects do not fit neatly within physical, digital, or 
hybrid categories. 

These hypothetical examples show the complexity of crime and how difficult it 
can be to determine proper classifications. They also show that pure categories are rare 
and most crime has some degree of crossover. It is the degree of crossover that helps 
determine whether a crime has evolved into a new classification, which is how the 
“hybrid crime” classification was created. The label of “hybrid” would never have come 
to fruition for border-related crime if it were not for various social, environmental, and 
technological pressures. The next section explains those pressures that caused cross- 
border crime to evolve into hybrid crime. 

B. CROSS-BORDER CRIME: RIPE FOR TRANSFORMATIVE CHANGE 

Committing crime is similar to all other high-risk activities; criminals always 
attempt to take the easiest path to success. The easiest path will always be the natural 
course of action among many possible courses. Although there are legal high-risk 
activities, such as initiating a start-up company, criminal actions carry the highest risks. A 
failed start-up company might result in financial ruin, but failure to successfully commit a 
criminal act can lead to long-term incarceration or even death. Consequently, criminals 
are always looking for new paths through with to commit new, unique crimes, or to 
commit old crimes in unique ways. 

Technological innovations disrupt the law enforcement-crime balance in much 
the same way that they disrupt the business economy. According to an article about 
disruption for entrepreneurship, “when you’re disrupting an industry, you can focus on 


18 



end goals without having to follow a traditional path.”50 The same ean be said about 
erime. When a eriminal uses a teehnology for the first time to faeilitate a erime, it 
disrupts the law-and-order balanee and makes it diffieult for law enforeement to respond 
adequately.^ 1 Following a predietable pathway to eommit erime makes it relatively easy 
for law enforeement to identify the erime and respond, espeeially if the eriminal uses 
physieal elements. When teehnology enters the equation, it ehanges known objeets and 
therefore the predietability of aetions that stem from those objeets. Criminal use of 
innovative teehnologies ean thus render law enforeement teehniques ineffeetive. 

Disruption can occur in business or crime only if the environment is ripe for 
transformative change.Cross-border crime was ripe for change due to three pressures. 
This pressure first came about from increased enforcement against cross-border 
smuggling, which caused criminals to search for alternative techniques to commit crime. 
Enforcement pressure was supported, second, by Internet technologies that were found to 
fulfill elements of the criminal activity; criminals began to implement the technologies to 
overcome the increased border enforcement efforts. Third, the technologies proliferated 
among criminal consumers because of a changing popular mindset that Web-based social 
networks offer a sense of community and trust. The end result (as shown in Figure 1) was 
the creation of a hybrid category for cross-border crime. 
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4, 2014, https://www.entrepreneur.com/article/235881. 
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Hybrid Category Forms for 
Cross-Border Crime 


Figure 1. Combined Pressures Create Flybrid Crime 


1. Pressure from Strong Border Enforcement 

The United States made border security an enforcement priority long before 
“build the wall” became an iconic phrase. Over the years, border security efforts have 
focused variously on illegal immigration, drug smuggling, and terrorism. Starting in 
1986, the United States dramatically increased the amount of resources expended on 
reducing the flow of illegal immigrants coming into the United States across the Mexico 
border.53 From 1993 to 1999, the Immigration and Naturalization Service’s budget nearly 
tripled.^4 a large part of that budget was spent on increasing the number of Border Patrol 
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agents at the southern border, from 3,389 to 8,200.55 Another portion of the budget was 
used to purehase teehnology, ineluding eameras, sensors, and night vision goggles.56 

The war on drugs was another souree of pressure exerted on eross-border eriminal 
activity. This “war,” which started in the 1960s, increased enforcement resources 
throughout various administrations for decades and uniquely included law enforcement, 
military, and intelligence assets.57 From 1964 to 1968, the U.S. Customs Service 
achieved increased marijuana seizures from 7,000 pounds to 65,000 pounds. 58 From 
1981 to 1989, federal cocaine seizures increased from two tons to one hundred tons.59 
The increase in resources to stop the Colombian cocaine trafficking problem in south 
Florida resulted in pushing criminal activity from Florida to the U.S.-Mexico border.60 
The interlinking of Colombian traffickers with Mexican traffickers created new criminal 
networks and resulted in even more enforcement resources being expended to stop the 
flow of drugs.61 

When the Department of Homeland Security was created after 9/11, border 
enforcement was again strengthened by two new agencies: U.S. Customs and Border 
Protection (CBP) and Immigration and Customs Enforcement (ICE). CBP was created for 
interdiction of cross-border crime. As part of CBP, the U.S. Border Patrol grew the most 
after 9/11; in 2003, the USA PATRIOT Act increased Border Patrol’s budget by $300 
million.62 The Secure Pence Act provided funding for an additional 3,000 Border Patrol 
agents and another $244 million budget increase in 2006.63 As of 2016, CBP had a $13.3 
billion budget and grew to approximately 59,000 employees; in the same fiscal year, the 
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Border Patrol made 415,816 apprehensions, while CBP offieers arrested 8,129 people for 
serious erimes and stopped 274,821 inadmissible aliens from entering the United States at 
ports of entry. also seized over 2.9 million pounds of nareoties, $105 million in 
eurreney, and 733 outbound weapons. 65 

ICE was ereated to eonduet investigations and interior enforeement designed to 
strengthen border seeurity by foeusing on transnational erimes. Like CBP, ICE has also 
seen signifieant growth sinee its ereation after 9/11. As of 2016, ICE had a $6.2 billion 
budget and approximately 20,000 employees. 66 Eor fiseal year 2016, ICE’s Homeland 
Seeurity Investigations (HSI) made 32,709 eriminal arrests and 6,544 administrative 
arrests while ICE’s Enforeement and Removal Operations removed 240,255 illegal aliens 
from the United States. 6^ 

It is diffieult to measure the effeetiveness of these efforts, and doing so is not the 
foeus of this thesis. What matters for this study is that there has been a dramatie inerease 
in border enforeement that has ereated pressure on eross-border erime. That pressure 
foreed eriminal aetors to adapt. Adaptation led to a seareh for alternative means to 
eommit erime and the diseovery that eertain Internet teehnologies eould faeilitate 
eriminal aetions. The following seetion explains the Internet teehnology innovations that 
helped eross-border erime evolve into hybrid erime. 

2. Pressure from Internet Technology Innovations 

While enforeement efforts were making smuggling more diffieult, teehnologieal 
advanees simultaneously expanded options for eriminal aetivity. Criminals operate in a 
mindset that distaneing themselves from the physieal elements of eriminal aetivity give 
them a better ehanee of eluding arrest. In the past, that distanee was ereated by using 
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third-party proxies to commit physical crimes. Today, the Internet has become the proxy, 
effectively creating distance between crime and physical actions. 


The Internet has been used for many years as a platform to commit pure 
cybercrimes involving fraud, theft, and extortion through distributed denial of service 
attacks, spear phishing, spam, ransomware, or malware.However, using the Internet to 
facilitate traditional physical crimes like drug trafficking, human trafficking and sexual 
exploitation, and money laundering is a much newer phenomenon. This phenomenon has 
only become possible because of developments such as Tor, cryptocurrencies, tumblers, 
and peer-to-peer file transfer protocols. These technological innovations have allowed 
communications, digital file transfers, and money transactions to occur anonymously on 
the dark web. Once these new technology innovations were discovered, it was a small 
leap to perceive additional criminal uses for the Internet and to form hybrid crime. 

The onion router Tor has made the dark web a place where deviant behavior 
remains anonymous. Tor is software designed to anonymize user identities by routing 
communications through various nodes on a worldwide network in a way that does not 
permit sources or destinations to see one another. jor software also allows for hidden 
website development in the deep web.^0 jor was developed in collaboration with the 
Naval Research Laboratory, DARPA, and the Massachusetts Institute of Technology to 
allow the U.S. military to securely communicate with foreign intelligence and military 
assets overseas.Released to the public in 2004, Tor has been used legitimately by 
individuals or businesses who wish to protect personal identities while conducting 
competitive research, by activists and whistleblowers who report abuses, and by 
journalists who wish to consult sensitive sources. ”72 
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Hybrid crime is difficult to commit without the ability to anonymously transfer 
money. Cryptoeurreneies were the teehnologieal solution to that problem. Bitcoin is a 
virtual eryptoeurreney that was introduced in 2009 based on a white paper written by an 
author using the pseudonym Satoshi Nakamoto.^3 Biteoin uses peer-to-peer transaetions 
that do not require a third party to proeess monetary transactions. Transactions are 
pseudo-anonymous beeause users and Biteoins are enerypted and rely on eryptography to 
validate transaetions, but are reeorded on a publie ledger ealled a bloekehain.^5 Biteoin 
was invented so transaetions on the Internet eould be “based on eryptographie proof 
instead of trust,” whieh allows for decentralized payments outside tinaneial institutions. 

A Biteoin tumbler helps make transaetions more anonymous by manipulating the 
bloekehain, whieh obfuseates the path between a “buyer’s Biteoin address and the 
vendor’s Biteoin address. 

Peer-to-peer file transfer protoeols allow users to transfer large amounts of data 
through the Internet. BitTorrent is an example of an open-souree protoeol that allows big 
data to be segmented into smaller components, transferred through a peer-to-peer 
network, and then reassembled.^^ BitTorrent has been used for legitimate transfers of 
large amounts of information by Faeebook, Twitter, Florida State University, and 
Blizzard Entertainment.^^ However, eriminals have found that when BitTorrent is 
eombined with other teehnologies, transfers ean be made pseudo-anonymously.^® As a 
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result, criminals have used BitTorrent protocol to transfer pirated movies, music, 
software, and child pornography. 

The technologies of Tor, cryptocurrencies, tumblers, and peer-to-peer fde transfer 
protocols have made the Internet valuable for facilitating cross-border crime. While none 
of these technologies were specifically designed for the purpose of committing crime, 
their development and subsequent criminal discovery impacted the criminal environment 
and made hybrid crime possible. When criminals realize these technologies’ values, the 
combined pressure from increased border enforcement created a market that was ripe for 
transformative change. The final pressure that allowed hybrid crime to flourish in this 
emergent environment was social acceptance. The next section explains how social 
network acceptance legitimized darknet marketplaces in the public mind. 

3. Social Network Acceptance 

One of the most significant impacts the Internet has had is the creation of virtual 
communities through social network services like Facebook, Myspace, and Twitter.^2 
These types of social networks have connected hundreds of millions of people into virtual 
communities of like-minded individuals.The individuals feel they are part of the 
community by having forum discussions that help build virtual bonds. Although these 
bonds are merely virtual, they create a sense of social acceptance and trust. 

Media dependency theory explains why people support social networks; the 
theory proposes that there exists “an internal link between media, audience and large 
social system[s].”^‘^ As individuals rely more and more on their media platforms in order 
“to comprehend and understand the world around them,” they build trust in those 
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platforms.Individuals also build relations into the soeial network through dependencies 
of understanding and orientation.86 While dependency of understanding relies on 
community support to explain “one’s own beliefs,” dependency of orientation explains 
how people behave in various social relationships.^^ As people became more dependent 
on the Internet as a medium and on social networks as communities, darknet 
marketplaces were a natural progression—an extended community of trusted virtual 
“friends.” 

The popular mindset that supports social networks on the Surface Web transferred 
the same sense of belonging, social comfort, and trust to darknet marketplaces. Dark 
networks are a component of darknet marketplaces and an extension of accepted social 
networks from the Surface Web. Like social networks on the Surface Web, dark networks 
build virtual social communities. The difference between Surface Web and dark web 
social networks is the level of secrecy and anonymity. Dark web networks allow for 
discussions and activities that are normally considered deviant to be conducted 
anonymously. Forum discussions could include questions about illegal drug use, where to 
obtain certain drugs, or how to locate child pornography. The connections these networks 
facilitate are significant; in 2015, a researcher found that “just one Dark website alone 
had more than twenty-seven thousand registered pedophile members in its forums.By 
fostering online reputation systems, darknet markets have also been extremely successful 
at building an online community of trust.^9 

Surface Web and dark web social networks have the same output; they grow 
virtual social communities of like-minded individuals through engagement. Trust in these 
virtual communities is a strong motivator for members who decide to use technology to 
commit crime. Once a person is a part of the virtual community, that person trusts the 
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other community members and the technology to protect his identity. Through 
discussions and online observations, those who are inclined to commit crime are 
motivated to use the trusted technology to do so. This has become the new normal for 
committing crime. 

In summary, environmental, technological, and social pressures have combined to 
transform cross-border crime into a new hybrid category of crime. In itself, a new 
category is just a label used to determine typologies of crime; a changed label would not 
matter if it did not directly impact law enforcement. In this case, however, the new 
category affects law enforcement’s real-world understanding of cross-border crime. It has 
also impacted the effectiveness of known enforcement techniques. Better hybrid criminal 
methodologies have resulted in criminal activity that is difficult to identify and deter. It is 
important to understand the causal relationship between law enforcement and criminal 
activity to grasp the real-world consequences of these criminal adaptations. Only once 
this relationship is understood can law enforcement analyze actions and reactions to 
possibly predict future changes in criminal activity. The relationship between law 
enforcement and criminal activities is explained further in the following chapter. 
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III. THEORETICAL ERAMEWORKS AND CONCEPTS 


If the affordances of a thing are perceived correctly, we say that it looks 
like what it is. But we must, of course, learn to see what things really 
are—for example, that the innocent-looking leaf is really a nettle or that 
the helpful-sounding politician is really a demagogue. And this can be 
very difficult. 


—James J. Gibson^O 


A. WHY HYBRID CRIME WAS CREATED: STIGMERGY 

Which came first, the chicken or the eggl This causality dilemma is intended to 
make us think about how two objects that have a causal relationship came into being. 
Deviant behavior and criminal justice, too, have a rife causal relationship; it is unknown 
how each influences the other. This makes it difficult to determine if new crime 
originates on its own or out of a response to enforcement activity. Perhaps it does not 
matter whether the chicken or the egg came first. But it does matter whether criminal 
enforcement of crimes initiates new or emergent criminal activities; this determination 
may help law enforcement reflect on results, identify unintended consequences, or even 
anticipate future crimes. Crime and law enforcement’s causal relationship—and its 
which-came-first dilemma—is the start of a bigger discussion about how all actions 
within a causal relationship have reactions. 

The actions and reactions between crime and law enforcement can be further 
explained by another metaphor: the cat and the mouse. Like the chicken or the egg, the 
cat and the mouse metaphor is also commonly used to explain the relationship between 
law enforcement and criminals. The cat and mouse have a causal relationship in which 
they entice actions from one another in a game that continues indefinitely. Law 
enforcement (the cat), is constantly trying to catch the criminal (the mouse), in a “game” 
of law and order. Both metaphors can help explicate a concept central to this research that 
explains how hybrid crimes came about. That concept is stigmergy. 
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Stigmergy, in terms of crime and law enforcement, is very much a combination of 
the aforementioned metaphors. Stigmergy is a concept meant to explain how agents, 
including human beings, achieve self-organization in decentralized group settings.As 
previously mentioned, the concept was first introduced in 1959 by zoologist Pierre-Paul 
Grasse, who used the study of ethology to explain how termites self-organize to create 
complicated termite mounds.92 By studying termites, Grasse concluded stigmergy was 
the “indirect communication mediated by modifications of the environment.”93 He 
concluded termites leave a pheromone that directs the colonies’ cooperative actions.94 
Since first introduced, stigmergy has been used to explain nest building, animal 
swarming, physical human movement in the formation of pathways, evolution of 
software development, product-driven systems in manufacturing, and sensor-driven 
networks.95 In these examples, stigmergy has been used to explain actions and reactions 
in complex relationships that could not otherwise be explained. 

Stigmergy is not commonly used to explain the complex relationship between 
criminal activity and law enforcement, and it has not previously been used to specifically 
explain the creation of a new category of crime. In a criminal justice context, stigmergy 
has been used to explain how drug smuggling has become resilient, in part because of the 
adversarial cycle of law enforcement and drug smugglers in the border setting.96 Rodrigo 
Nieto-Gomez explains how enforcement against drug smuggling has created inadvertent 
resilience in the illegal drug supply chain. 92 He posits that human interactions between 
criminal and law enforcement activities create indirect indicators that influence one 
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another.98 In other words, if law enforcement uses a new enforcement technique that 
effectively counters certain criminal activity, that action sends out an indirect signal for 
criminals to adapt their criminal activity. In reverse, if criminals devise new ways to 
commit criminal activity, that action sends an indirect signal for law enforcement to adapt 
enforcement efforts. 

Nieto-Gomez’s research provides a viable explanation for how these indirect 
signals build resilience within criminal networks, and identifies technology innovation as 
a way to “shock” the system to impact the cat-and-mouse game.^^ For this study, Nieto- 
Gomez’s most important finding relates to the continuous cycle of criminal activity— 
how criminal activity influences change for law enforcement, and how law enforcement 
in turn influences change for criminal activity. The indirect signals flow in both 
directions, effecting change for both decentralized groups. 1^0 Stigmergy identifies 
actions and reactions in the cycle but, despite this valuable advancement, does not answer 
the chicken-or-the-egg question. This is still an important question; determining whether 
a specific enforcement technique causes criminal activity to change, or whether criminal 
activity causes law enforcement to react, helps determine proactive or reactive law 
enforcement efforts. Determining which came first could also help predict changing 
typologies of crimes. 

Given the stigmergic cycle of law enforcement and crime, it is clear that hybrid 
crime was created when criminals faced increasing difficulties committing border-related 
crimes using traditional means. The starting point of the cycle, however, is difficult to 
determine. Did law enforcement efforts push criminals toward Internet technologies, or 
did criminal actors simply seek innovation on their own? The cause-and-effect dilemma 
is compounded by criminal or enforcement activities that do not leave signals on the 
Internet, as they do in the physical realm. What is known is that when drug smuggling 
moved from a purely physical crime to a crime that combined physical and digital 
elements, enforcement became more difficult. The new hybrid crime category forced law 
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enforcement to adapt and to advance their understandings of Internet technologies to 
match the threat. 

Stigmergy is a perfect concept for explaining the constant cat-and-mouse cycle of 
law enforcement and crime, but it does not help predict future crimes. It can only predict 
that there will be future crimes. Affordance theory, on the other hand, offers law 
enforcement both prospective and ex post facto analysis of criminal activity in greater 
granularity. Because affordance theory can innovatively perceive action-object 
possibilities of Internet technologies, it shows promise for predicting future crimes. The 
next section explains how affordance theory is valuable for analyzing hybrid crimes and 
how it may help law enforcement predict future crimes. 

B. AFFORDANCE THEORY: THE ANSWER TO THE ANALYSIS 

1. Affordance Theory, Law Enforcement, and the Internet 

The use of Internet technologies to commit criminal activity has made it 
increasingly important to expand the study of criminal justice and criminology. 
Traditional reliance on sociology is beneficial for understanding deviant behavior, but it 
does little to advance investigative techniques capable of stopping hybrid crimes. The 
theory of affordances has been used extensively in designing digital and physical objects 
and can be valuable in the analysis of criminal activity. The value lies in the theory 
having the ability to analyze digital and physical actions equally. As traditional crimes 
hybridize physical with digital elements, the value of the theory becomes even more 
important. Affordance theory is ideally suited to advance the fields of criminal justice and 
criminology by analyzing hybrid crimes. 

Affordance theory has not been used to assess crime, so important concepts must 
be extrapolated from other fields of study. Design theory is a good place to start; 
affordances have been studied extensively to advance development of physical and 
digital objects. Design theory requires an understanding of affordances to create physical 
and digital objects that have obvious uses. Designers want to create objects that are easy 
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to use and that function as intended. Criminal justice can benefit from affordance 
theory, in contrast, by using it to identify action-object possibilities that might facilitate 
crime. If law enforcement is able to identify and understand these affordances, it will be 
better equipped to respond to objects’ new criminal uses. 

Design theory helps explain how affordances factor into the causality relationship 
between an object and the way someone uses that object to perform an action. 102 jn the 
simplest of terms, an affordance is “a relationship between the properties of an object and 
the capabilities of the agent that determine just how the object could possibly be 
used. ”103 For instance, a shovel is typically used to dig a hole (affords being thrust into 
the dirt), but can also be used to bludgeon someone (affords being swung). These actions 
allow a person to employ the shovel’s intended use, thrusting to dig a hole, but also an 
unintended use, swinging to exert blunt force trauma and potentially commit murder. 
Though graphic, this example illustrates how a physical object’s perceived affordances 
can lead to an unintended use. While objects’ intended uses are obvious, determining 
their unintended uses requires creative insight. 

As with violent crimes, criminals may commit cross-border crimes with the help 
of everyday objects. For example, a gas tank is normally used to store gasoline for 
fueling a vehicle; a drug trafficker, however, can use a gas tank to store and conceal 
bricks of cocaine. A tractor trailer can transport produce from Mexico to the United 
States, but it can also be used to smuggle illegal aliens across the border. Physical action- 
object relationships are easy to comprehend because they are tangible, but not all action- 
object relationships are as readily discernable. 

The digital realm holds just as many action-object relationships as the physical 
realm, but they are more difficult to illuminate—which is one challenge law enforcement 
faces as criminals increasingly employ digital objects to facilitate cross-border crimes. As 
an example, a computer can be used to create and store spreadsheets that document 


101 Norman, The Design of Everyday Things, 4—12. 

102 Ibid., 11. 

103 Ibid. 
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business profits or losses, but a eomputer ean also be used to smuggle digital intelleetual 
property from the United States to China. Most of the world uses the Internet for soeial 
eommunieations, personal business transaetions, and government and private-seetor 
business funetions. But eriminals ean injeet viruses into the Internet that are eapable of 
stealing personal information or affeeting the operability of a eompany’s network. 
Beeause the Internet affords eommunieation for both eriminal and noneriminal purposes, 
with equal ease, there are many possible Internet affordanees to faeilitate eriminal 
aetivity. 

As stated previously, onee an individual reeognizes the Internet’s eriminal 
potential, the unique affordanees abound; it is only a matter of ereativity to find the 
easiest pathway to sueeess. Design theory uses a eoneept ealled “natural mapping” to 
identify a spatial assoeiation between an objeet and what the objeet does. 1^4 while 
natural mapping in design theory’s traditional sense leads to obvious results—e.g., push 
this button and this object moves —natural mapping of the Internet is more abstraet. 
Those who possess the ereativity to understand and appreeiate the Internet as a eomplex 
system of systems ean manipulate the positive attributes of borderless eommunieation, 
unlimited eommeree, and most reeently anonymity, by visualizing a map for how the 
Internet ean faeilitate erime. As with physieal natural mapping, individuals with unique 
digital mapping abilities ean identify a digital spatial realization on the Internet: if I push 
this button, this result will occur. 

It is important for law enforeement to prediet teehnologies’ aetion-objeet 
relationships that lead to erime, or how Internet teehnologies may be mapped to 
transform erime. It is possible for anyone to prediet aetion-objeet relationships; after all, 
“the affordanee of something does not ehange as the need of the observer ehanges. The 
observer may or may not pereeive or attend to the affordanee, aeeording to his needs, but 
the affordanee, being invariant, is always there to be pereeived.’’^^^ In other words, 
eriminals do not own the rights to unloeking new teehnologieal keys. Internet teehnology 


Norman, The Design of Everyday Things, 22. 

Gibson, “Ecological Approach to Visual Perception,” 138-139. 
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affordances are omnipresent: anyone ean pereeive them at any time. Law enforeement 
and eriminals have equal opportunity to pereeive and identify Internet affordances. One 
way to examine predictive actions in order to identify crime is through modeling. The 
following section explains the seven stages of action —a model that can be used for 
predicting crime. 

2. Modeling of Criminal Actions 

Don Norman uses a model called the seven stages of action (shown in Figure 2) to 
determine human actions for design theory. 10^ While there is no set beginning or ending 
point for the model, its concluding point is the accomplishment of a certain goal. After 
identifying a goal, the stages of execution run through planning, specifying the action(s) 
needed, and performing. Once those actions are taken and they interact with the 
environment, a person can evaluate the results. The evaluation has three steps: perceiving 
how the environment impacts actions, interpreting how the action interacts with the 
environment, and finally comparing the action outcome against its goal. 


106 Norman, The Design of Everyday Things, 40—41. 
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Figure 2. Norman’s Seven Stages of Aetion^O^ 


Norman uses a simple example to explain the model: he deseribes how a person 
determines, plans, and ultimately moves a switeh to turn on a light; however, the seven 
stages ean also prove benefieial for modeling eriminal aetions—speeifieally, how 
teehnology ean be used to eommit erime.^®^ The benefit for this study is in the inverse 
analysis. The goal of using the seven stages of action is not to design a product 
(technology) that is user friendly, but rather to reverse-engineer technology to predict 
how it might be used in the future to commit crime. It might also allow predictive power 
to determine when a crime is ripe for transformative change. 

Figure 3 is an adaptation of Norman’s model showing cross-border crime actions 
resulting in hybrid crime. The model was populated using the Silk Road as a case study. 
The goal for criminals who used the Silk Road was to “commit cross-border crime.” The 
bridge of execution moved through perceiving digital affordances for crime; specifying 


Source: Norman, The Design of Everyday Things, 40-46. 
108 Norman, The Design of Everyday Things, 40. 



















the digital and physical elements of the dark web, Tor, Bitcoin and the U.S. Postal 
Service; and implementing a darknet marketplace. Once those actions interacted with 
real-world pressures, the model moved into the evaluation stage. The bridge of evaluation 
demonstrates how the increased border enforcement influenced actions toward the goal. 
Criminals perceived a high risk for committing border-related crime; they interpreted this 
risk by recognizing the need for anonymity, which could distance them from physical 
criminal actions, and by recognizing that hybrid crime is the best option for achieving the 
goal. In the case of the Silk Road, the actions were extremely effective for accomplishing 
the goal and ultimately creating hybrid crime, 
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Figure 3. Adapted Model of Criminal Actions for Cross-border Crime ^ 


These aetions are explained more in Chapter IV. 

^ Adapted from Norman, The Design of Everyday Things, 40^6. 
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3. 


Constraints 


Constraints are an important component to consider when determining action 
possibilities of any object, whether digital or physical. Norman identifies four constraints 
that limit action and the perception of affordances: physical, cultural, semantic, and 
logical, m An example of a physical constraint for a hybrid crime would be the inability 
to smuggle drugs physically across the border using the Internet. A cultural constraint 
could be a person’s ethics. For example, an ethical person might not be able to mentally 
conceive a heinous criminal act. A semantic constraint limits actions based on past 
knowledge of norms. 112 At one time, for example, a carriage could not afford movement 
if it was horseless. That affordance constraint changed once automobiles—then referred 
to as horseless carriages—^were invented. A logical constraint limits action possibility to 
logical, realistic responses.! 12 For instance, if someone is putting a puzzle together and 
there is only one piece remaining, it is logical where the one puzzle piece must be placed. 

In design theory, constraints guide product development, ensuring the products 
function properly and realistically, and in ways that are obvious to users. 114 Criminals 
may view constraints as an obstruction to overcome in order to commit crime. For the 
study of crime, constraints should be viewed as a tool to limit the scope of possible 
actions for a given object. Constraints can focus on perceiving technological affordances 
to determine possibilities for disrupting crime, rather than on more manageable criminal 
uses of technology. However, because action possibilities from Internet technologies are 
intangible, it is not so simple a feat to limit actions based on constraints. 

For the purposes of this study, constraints can both simplify and complicate 
affordance theory analysis. If done properly, determining an object constraint can prevent 
wasted analysis for a technology that cannot perform a certain function. Inversely, an 


111 Norman, The Design of Everyday Things, 125. 

112 Ibid., 129-130. 

112 Ibid., 130. 

114 Ibid., 123-132. 
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improper constraint determination can lead to misperceptions about technologies’ 
criminal uses and inadequate predictability. 

The next chapter uses the Silk Road darknet marketplace as a case study to 
identify how technologies afforded unique ways to commit cross-border crime. The Silk 
Road was the first darknet marketplace of its kind and was the originator of large-scale 
hybrid crime. As shown in the case study, law enforcement had difficulty adapting to the 
changing criminal typology and used traditional enforcement techniques to counter 
hybrid challenges. The second case study, in Chapter V, looks at the Silk Road 2.0 and 
shows how law enforcement adapted techniques to better handle the challenges of 
hybrid crimes. 
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IV. CASE STUDY 1: THE SILK ROAD 


During the past fifteen years, technological innovation and globalization 
have proven to be an overwhelming force for good. However, 
transnational criminal organizations have taken advantage of our 
increasingly interconnected world to expand their illicit enterprises. 

—President Barack Obamall^ 

This chapter reviews the Silk Road darknet marketplace to explain the challenges 
law enforcement faced when trying to stop illegal drug smuggling facilitated by the 
Internet. The first section of this chapter explains what the Silk Road is, who created it, 
and the technologies that afforded the creation of a new hybrid category of crime. As part 
of the explanation, the Silk Road’s unique Internet technology uses are compared with 
normal uses, in an effort to identify affordances. The second section shows the 
investigative techniques law enforcement used to respond to the Internet’s new 
technological uses. What is especially significant in this section is how law enforcement 
was able to use traditional investigative techniques to overcome the hybrid crime, despite 
its inability to overcome new criminal uses of Internet technology. This section highlights 
areas of vulnerability within hybrid crime and identifies a starting point in the stigmergic 
cycle that exists between criminals and law enforcement. The final section provides 
conclusions about affordances vis-a-vis law enforcement adaptability. 

A. FOLLOW THE SILK ROAD: THE GENESIS OF HYBRID CRIME 

The Silk Road was the first darknet marketplace of its kind and relied on unique 
Internet technologies to facilitate crime. Like its namesake, the 4,000-mile ancient trading 
route linking China to Rome, the Silk Road involved global commercial activity. 
However, unlike the ancient trading commodities of silk, wool, gold, and silver, the 
commodities of the Silk Road comprised illegal drugs, guns, stolen credit cards, 
fraudulent documents, computer viruses, child pornography, and murder for hire.^l^ This 


1Andreas, Smuggler Nation, 331. 
11^ Goodman, Future Crimes, 245. 
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illicit marketplace ereated an easy pathway for eriminals to eommit erimes, sheltering 
them from prosecution and allowing them to profit from illicit gains. Ross William 
Ulbricht (also known as “Dread Pirate Roberts”), the sole ereator of the Silk Road, 
understood the Internet’s eomplexities as a system of systems and envisioned new, 
unique uses for its teehnologies.^^ 

Ulbrieht started to envisage the Silk Road sometime between 2008 and 2010 
when he was approximately twenty-five years old.^^^ His desire to create a darknet 
marketplaee was preeipitated by his libertarian belief in free markets, and his objection to 
government eontrol of eonsumerism, to inelude the sale and purehase of illegal drugs.^^^ 
Beeause he was not a nareotraffieker, eareer eriminal, or serious drug user, Ulbrieht did 
not fit the typieal eriminal profile. Moreover, without eomputer seienee eredentials or 
past work as a programmer, he seemingly laeked the teehnieal ability to ereate a 
signifieant darknet market. A baehelor’s degree in physies and a master’s degree in 
seienee and engineering, however, may have trained him to pereeive affordanees more 
ereatively than the average eriminal. 1^0 

The path Ulbricht took to perceive and eonceive a darknet criminal marketplace is 
eritieal to this study. His ability to map unintended signifiers led him to reeognize— 
before anyone else—a set of yet unrealized aetion-objeet relationships, or affordanees, 
for Internet technologies. A signifier is a pereeption or sign of an objeet’s potential.1^1 
Signifiers go hand-in-hand with affordanees; in the normative eontext of design theory, a 
signifier must be readily apparent to build user-friendly produets.^22 Unlike in design 
theory, however, unintended signifiers in the eontext of Internet-faeilitated erime are not 
obvious or apparent unless the teehnology is designed speeifieally for the purpose of 
eriminal aetivity. 

Goodman, Future Crimes, 245-249. 

Bilton, American Kingpin, 33. 

119 Ibid., 20, 22,34. 

120 Ibid., 14; Goodman, Future Crimes, 249. 

121 Norman, The Design of Everyday Things, 13-19. 

122 Ibid. 
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The first affordance Ulbricht perceived was the Internet itself. Though Ulbricht 
was not the first to recognize that the Internet afforded criminal activity, he pioneered its 
use to convert purely physical smuggling into a digital-physical hybrid crime. The new 
hybrid category maintained both physical and digital components; rather than 
constraining the Internet to its intended uses (e.g., sharing research and facilitating social 
connectivity), Ulbricht identified unintended signitiers that facilitated border-related 
crime. 

While the possibility to intermix elements of physical crimes and cybercrimes was 
not new, it had never been accomplished as successfully as in the Silk Road. In the past, 
smuggling was achieved by the illegal physical movement of people or goods in and out 
of the United States—a person had to physically smuggle a commodity and receive illicit 
payment, making it a traditionally physical crime. In the more recent past, smuggling also 
became digital for certain commodities, such as intellectual property and child 
pornography. Those specific commodities could have remained digital forever, resulting 
in purely traditional cybercrimes. Using the Internet, however, Ulbricht intertwined 
purely physical smuggling into an interdependent relationship with the digital realm. 

Ulbricht realized the Surface Web could not completely serve his needs; although 
it afforded the global connectivity and communications needed for a marketplace, it did 
not afford anonymity. In search of anonymity, Ulbricht’s mapping of Internet affordances 
led him to the deep web, which is intended for large data storage. 1^3 He perceived the 
deep web’s secrecy as a means for concealing illegal activity, his own identity, and the 
identities of drug vendors and buyers. Using the deep web as a platform, Ulbricht could 
make the Internet a central feature of smuggling while retaining anonymity. The sector of 
the deep web that afforded Ulbricht this capability, along with global connectivity and 
communications, was the dark web. 

Ulbricht next began to seek Internet technologies that would afford criminal 
advantages, the most valuable of which was Tor. Originally developed to allow the U.S. 
military to securely communicate with foreign military intelligence and overseas assets, 

Bilton, American Kingpin, 34. 
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Ulbricht first learned about Tor in online ehat rooms as early as 2009.124 Despite Tor’s 
known affordanee, Ulbrieht was eonstrained neither by its intended aetion properties nor 
by the laek of new ideas; he reeognized signifiers that Tor eould be used to faeilitate 
hybrid erimes—namely, the seeurity and anonymity required to ereate a darknet 
marketplaee. 

At this point, Ulbrieht had identified all the teehnologies needed to build a darknet 
marketplaee; the only missing pieee was the ability to reeeive anonymous payments for 
illegally smuggled goods. 125 a market of this kind could not rely on traditional financial 
institutions or cash payments because of the continuing necessity to remain anonymous 
and the large volume of transactions. This part of the crime had to remain digital. 
Ulbricht realized he could only act on his plan if there was a way to anonymize online 
payment transactions. 126 In 2010, he discovered that Bitcoin and Bitcoin tumbler could 
fulfill these missing affordances.122 Bitcoin was developed to decentralize online 
payments outside of the banking system. 128 Bitcoin payments are pseudo-anonymous, 
and a Bitcoin payment system can be built into a darknet marketplace itself Ulbricht 
wrote thousands of lines of code to connect Bitcoin to the other components of his hidden 
website. 129 He relied on a Bitcoin tumbler to further anonymize the online payments by 
mixing multiple transactions, making them harder to trace. 

Ulbricht had mapped out all the technological pieces for creating a darknet 
marketplace, and he was confident law enforcement could not counter the anonymity 
afforded by the technologies. He changed the rules of crime and crime enforcement when 
he made the online marketplace viable for smuggling illegal goods. Ulbricht’s unique 
ability to recognize affordances and unintended signifiers meant he had an advantage 
over law enforcement, which had not yet perceived the same action possibilities for the 

^24 Stone and Poladian, “Meet the Deep Web; Bilton, American Kingpin, 34 

125 Bilton, American Kingpin, 34-35. 
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dark web, Tor, Bitcoin or Bitcoin tumbler. In creating the Silk Road, Ulbricht had taken 
away much of the effectiveness of traditional border enforcement and investigative 
techniques. There were no longer individuals who could be surveilled on street corners, 
where they met to make drug transactions: the meeting would happen in the dark web. 
Drug “mules,” who could be apprehended and “turned” to cooperate with authorities, 
would no longer be bringing illegal drugs across the border; illegal drugs would be 
shipped directly to consumers through the U.S. Postal Service. Illicit cash payments or 
wire transfers could no longer be analyzed to identify suspects; payments would now be 
made by Bitcoin. Ulbricht’s creation of a hybrid crime was effective at stymying law 
enforcement efforts. 

In January 2011, Ulbricht launched the Silk Road under the URL 
tydgccykixpbubuz.onion, and later silkroadvb5piz3r.onion.130 Relying on the anonymity 
afforded by the new Internet technologies, Ulbricht thought he would not get caught. The 
modem Silk Road was in business from approximately January 2011 to September 2013 
before the website was seized and the creator arrested in San Francisco, California, by 
U.S. law enforcement. 131 In its two and a half years of operation, the Silk Road had 
approximately 957,000 registered user accounts, earned $1.2 billion in overall revenue, 
and profited $80 million in commission. 132 Figure 4 shows a screenshot of what the Silk 
Road website looked like and the variety of illegal goods for sale. 


130 Bilton, American Kingpin, 44; United States of Ameriea v. Ross William Ulbrieht, Sealed 
Complaint, Southern Distriet of New York, l:13-eb-06919-KBF, Oetober 2, 2013, 9. 

131 United States v. Ross William Ulbrieht, Sealed Complaint, 2. 
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Figure 4. Screenshot of the Silk Road Website 


Although Ulbricht was identified and arrested, there is no direct evidence that law 
enforcement was able to overcome the technology affordances he used to smuggle illegal 
goods. Ulbricht’s perceived signifiers and their technology affordances were accurate, 
and the crimes’ digital components performed well—Tor, Bitcoin, and Bitcoin tumbler 
maintained the vendors’ and buyers’ anonymity. The physical component of the crime 
also performed well—illegal drugs were successfully smuggled into the United States 
through the U.S. Postal Service, and only a small percentage of packages were seized 
through law enforcement interdiction efforts. Ulbricht’s perceived criminal Internet 
affordances, the product of his natural mapping, were sound. Fortunately for law 
enforcement, Ulbricht left a digital shadow in the Surface Web that allowed traditional 


Source: David Decary-Hetu and Luca Giommoni, “Do Police Crackdowns Disrupt Drug 
Cryptomarkets? A Longitudinal Analysis of the Effects of Operation Onymous,” Crime, Law and Social 
Change 67, no. 1 (2017): 59. 
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investigative teehniques to overeome his anonymity. The following seetion explains how 
law enforeement adapted to the challenges presented by the Silk Road. 


B. LAW ENFORCEMENT RESPONDS USING OLD METHODS 

This section summarizes how law enforcement investigated the Silk Road, 
explains how the Internet affordances on which Ulbricht relied impacted enforcement, 
and describes how law enforcement countered the affordances. While the Silk Road case 
study shows Ulbricht’s superior ability to recognize signifiers of Internet affordances, it 
also shows law enforcement’s perseverance to stop crime. Specifically, it shows how law 
enforcement adapted traditional investigative techniques to be effective against the new 
hybrid crime of border smuggling. 

The Silk Road investigation was a priority for many agencies and government 
officials. The main law enforcement agencies involved in the investigation included 
Immigration and Customs Enforcement’s Homeland Security Investigations (HSI), 
Federal Bureau of Investigation (FBI), Drug Enforcement Administration (DEA), U.S. 
Secret Service, U.S. Postal Inspection Service, U.S. Customs and Border Protection 
(CBP), and Internal Revenue Service (IRS). 1^4 Having so many agencies involved in the 
criminal investigation provided significant leverage of skills and authorities, but it did not 
prove helpful for resolving the case quickly. Eaw enforcement recognized the hybrid 
nature of the darknet marketplace, yet relied on traditional criminal and established 
cybercrime investigative techniques to overcome the Internet technologies’ anonymity 
affordances. Eaw enforcement did not devise new, smart hybrid investigative methods or 
directly perceive Internet affordances to counter the new smuggling technique. 

The CBP and HSI began investigating the Silk Road in October 2011, and 
realized that small personal-use quantities of drugs seized at the foreign mail unit in 
Chicago showed relational patterns.The CBP and HSI made thousands of drug 


134 “HSI Seizes Biggest Anonymous Drug Blaek Market Website and Assists in Arrest of Operator 
and Overseas Co-eonspirators,” ICE, aeeessed May 07, 2017, https://www.iee.gov/news/releases/hsi- 
seizes-biggest-anonymous-dmg-blaek-market-website-and-assists-arrest-operator-and. 
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seizures through normal inspeetion efforts.1^6 Beeause the drug sourees were both 
international and domestie, agents were able to categorize packages into groups based on 
how labels were completed, as well as the packages’ destinations and origins. These 
relational patterns helped identify the Silk Road’s level of activity through recognized 
similarities (for instance, the packages were shipped through the U.S. Postal Service) and 
allowed law enforcement to follow up with knock and talks—a technique in which 
officers visit an address of interest, knock on the door, and interview a person who might 
have information about specific criminal activity.137 When HSI conducted knock and 
talks at addresses listed on seized packages, they were able to identify the connecting 
factor; the Silk Road.^^^ These inspection and interdiction efforts—physical seizures, 
knock and talks, and interviews—are all traditional investigative techniques that 
successfully gathered evidence about the Silk Road, but they were not able to identify 
Ulbricht. 

Using an undercover technique, the HSI and DBA set up new Silk Road accounts, 
and took over existing accounts of users who were cooperating with the government. 1^9 
Through these undercover accounts law enforcement gathered evidence of drug 
smuggling, communicated directly with Ulbricht, and even made online undercover 
purchases. 140 xhis is an established, traditional technique frequently used to investigate 
cybercrimes; although it also enabled law enforcement to successfully gather evidence, it 
again was not able to identify Ulbricht. Although the HSI and DBA both had undercover 
communications directly with Ulbricht’s anonymous Internet pseudonym, Ulbricht’s 
understanding of Internet technologies’ anonymity affordances protected his identity and 
his computer’s IP address. 


1^^ Bilton, American Kingpin, 150. 

1^^ Bilton, American Kingpin, 5. 

138 Ibid., 6-7. 

139 Ibid., 83-85, 100-102, 239-241; United States v. Ross William Ulbrieht, Sealed Complaint, 11. 

140 Bilton, American Kingpin, 83-85, 100-102, 239-241; United States v. Ross William Ulbricht, 
Sealed Complaint, 11. 
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The FBI was the first to devise a method to identify Ulbrieht when investigators 
diseovered a vulnerability in a script written to update the Silk Road website’s login 
page.1‘^1 The vulnerability allowed the FBI to identify the IP address of a Silk Road 
server housed in Iceland; they seized an imaged copy and replicated the server, after 
which they were able to gather vast amounts of information about the Silk Road’s 
communication flow and inner workings—including individual communications, 
transactions, and Bitcoin exchanges—as well as evidence pointing to Ulbrieht as the 
site’s owner and operatord42 

Seizing servers is a common technique used in cybercrime investigations. Even 
with the server, however, the FBI was still unable to counter Ulbrieht’s Internet 
anonymity affordance. The one piece of information about the server that was crucial to 
eventually unraveling Ulbricht’s anonymity was the name of the server. Frosty. 143 
Eventually, using traditional investigative techniques, law enforcement was able to link 
the server’s name to Ulbricht’s computer, which was also named Erosty.144 

The IRS was the first to crack Ulbricht’s anonymity, but did so using traditional 
law enforcement techniques (analysis and subpoenas) rather than by identifying signifiers 
for new technology to counter Tor’s anonymity affordances. The IRS searched the 
Surface Web for the very first mention of the Silk Road and found a magic mushroom 
forum called Shroomery, as well as a second mention on a Bitcoin forum called 
Bitcointalk.145 Both posts were linked to the same user name, which was later linked to 
another post that mentioned a Bitcoin start-up company and noted an email address. 146 
When the IRS issued a subpoena to Google for the email address’s subscriber 
information, Ulbrieht was identified. 147 The IRS was then able to determine that 

141 Bilton, American Kingpin, 221-222. 

142 United States v. Ross William Ulbrieht, Sealed Complaint, 14-24;. Bilton, American Kingpin, 14- 
15, 221-223. 

143 United States v. Ross William Ulbrieht, Sealed Complaint, 32. 

144 Bilton, American Kingpin, 268. 

145 United States v. Ross William Ulbrieht, Sealed Complaint, 24-26. 

146 Ibid., 26. 
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Ulbricht’s personal email and a eomputer conneeted to the seized Silk Road server were 
located in geographic proximity to one another, in San Francisco. ^48 

Another direct correlation between Ulbricht and the Silk Road came from 
Ulbricht himself In an unrelated enforcement action, CBP intercepted a package from 
Canada, shipped to Ulbricht, containing nine counterfeit identity documents. 1^9 xhe 
documents were replications of legitimate documents from various states that had 
different names but the same photograph. 1^0 When HSI visited the address on the 
receiving end of the package, they encountered Ulbricht and realized that he matched the 
photograph on the documents. When questioned by agents, Ulbricht mentioned that, 
“hypothetically,” people could buy counterfeit identity documents from the Silk Road 

using Tor. 152 

Ulbricht was not arrested for purchasing the fraudulent identity documents, and 
HSI did not immediately understand the significance of the Silk Road. However, when 
the IRS searched HSI’s case management system and found this interaction, it was the 
first piece of evidence directly linking Ulbricht to the Silk Road. 153 xhe IRS also located 
an online post in which a person named Ross Ulbricht posed questions about coding and 
Tor. 154 The important part of the discovery was that the username on the forum was 
changed from “Ross Ulbricht” to “Frosty.”155 The FBI immediately recognized the 
connection to the name of the seized server and the computer owned by the Silk Road’s 

operator. 156 
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On October 1, 2013, Ulbricht was arrested in a San Francisco library; the 
anonymity he worked so hard to achieve and build into the Silk Road had been 
breaehed.l^^ He was extradited to the Southern District of New York where he was 
eventually placed on trial and found guilty of aiding and abetting the distribution of 
drugs, continuing a criminal enterprise, computer hacking conspiracy, fraud with 
identification documents, and money laundering conspiracy. 1^8 Qn May 29, 2015, 
Ulbricht was sentenced to life imprisonment and ordered to forfeit $183,961,921,159 

C. SILK ROAD CONCLUSIONS: AFFORDANCES ALMOST WIN 

The Internet affordances Ulbrieht found in the dark web. Tor, Biteoin, and Bitcoin 
tumbler worked perfectly to achieve anonymity. Because of the teehnologies, Ulbricht 
was able to aehieve his goal of ereating a darknet marketplaee. The Aehilles heel in 
Ulbricht’s plan was the vulnerabilities in transitioning drug smuggling from a purely 
physieal erime to a hybrid erime. Ulbricht’s downfall was in this transition. 

Because his darknet marketplace was hidden even from the digital world, Ulbrieht 
had to find a way to alert potential eustomers to its existence. To do so, he attempted to 
discreetly market the Silk Road on Surfaee Web forums. l^H This marketing attempt left a 
trail for law enforcement to follow. Ulbrieht also sought to personally obtain fraudulent 
identity doeuments through the Silk Road, a hybrid border-related erime of its own. 
When the fraudulent doeuments were interdicted and he mentioned the Silk Road 
“hypothetically” to HSl agents, the clue was eventually enough to link Ulbrieht to the 
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marketplace. Finally, a website maintenance programming mistake—a purely digital 
component of the crime—helped law enforcement identify Ulbricht’s server. 

As mentioned, law enforcement relied on traditional investigative techniques, 
including knock and talks, undercover activity, targeted interdictions, seizures, forensic 
analysis of electronic evidence, and analysis of open-source material. In defense of its 
ability to anonymize users, the Tor Project released a statement about Ulbricht’s arrest, 
explaining that only traditional law enforcement methods were used to identity and arrest 
Ulbricht. The Tor Project stated, “[Ulbricht] ‘made mistakes in operational security’ and 
was caught by ‘actual detective work’ rather than exploiting problems with Tor.”162 
research, too, could not find evidence that law enforcement relied on anything other than 
traditional investigative techniques. 

Ulbricht perceived using the Internet for an anonymous, free-market criminal 
enterprise; while Internet technologies were fully capable of communicating information 
anonymously between drug distributors and buyers, the Internet did not initially have the 
technology to anonymously transfer funds for drug transactions. Ulbricht’s creation of the 
Silk Road was stopped dead in its tracks until he learned of Bitcoin. Bitcoin, a virtual 
currency, can be considered disruptive technology; it was new, and it served as the final 
puzzle piece that allowed Ulbricht to create a darknet marketplace. While the Silk Road 
investigation demonstrates how Ulbricht perceived a signifier (developing a free market 
criminal enterprise) and how Bitcoin ultimately facilitated the affordance’s final 
realization, it does not demonstrate law enforcement’s ability to develop new 
affordances. 

The Silk Road investigation is the best documented example of a large-scale 
darknet marketplace used to implement Internet affordances that created hybrid crimes. 
Although law enforcement did successfully identify and arrest Ulbricht, and seize the 
Silk Road website, there is no indication that law enforcement was able to directly 
overcome Ulbricht’s Internet affordances. The dark web. Tor, Bitcoin, and Bitcoin 
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tumbler all performed as Ulbrieht had pereeived to maintain anonymity. Instead, law 
enforeement was able to indireetly overeome Ulbrieht’s Internet affordanees by relying 
on traditional law enforeement and established eybererime teehniques that eapitalized on 
the vulnerabilities ereated when Ulbrieht eonverted a purely physieal erime into a hybrid 
erime. 

Beeause law enforeement was not able to direetly overeome the teehnologies, not 
even Ulbrieht’s arrest, eonvietion, and life senteneing were enough to deter or prevent 
additional illieit entrepreneurs from ereating darknet eriminal marketplaees. Enforeement 
displaeed eriminals from the seized Silk Road, but darknet eriminal marketplaees still 
began to thrive, and the digital elements of the hybrid erime were not displaeed from the 
Internet baek into the physieal world. In other words, the seizure of the Silk Road simply 
displaeed the eriminal aetivity to a new digital street eorner in the Dark Web; it did not 
produee a erime-free neighborhood. Silk Road 2.0 was one of the darknet eriminal 
marketplaees ereated after the demise of the Silk Road. The following ehapter explains 
Silk Road 2.0 and diseusses law enforeement adaptability. 
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V. CASE STUDY 2: OPERATION ONYMOUS—CRIMINAL 
AEEORDANCE ANALYSIS EOR NARCOTRAEEICKING 


Underground websites sueh as Silk Road and Silk Road 2 are like the 
Wild West of the Internet, where eriminals can anonymously buy and sell 
all things illegal. 

—Peter Edge, Executive Associate Director, HSI^^^ 

Operation Onymous was a multi-agency global operation that began on 
November 5, 2014, to respond to a large number of darknet marketplaces created after the 
seizure of the Silk Road. silk Road 2.0 was one of the marketplaces that law 
enforcement seized during the operation.165 chapter reviews Silk Road 2.0 to 

explain the challenges law enforcement faced when trying to stop illegal drug smuggling 
facilitated by the Internet. The first section describes Silk Road 2.0 and its creators, and 
briefly discusses the technologies that afforded the new hybrid crime category. As part of 
the discussion, this section explains the continuing stigmergic cycle between criminals 
and law enforcement through the creation of numerous darknet marketplaces identified 
during Operation Onymous. The second section shows how law enforcement learned to 
adapt to hybrid crime and overcame anonymity afforded by Tor. It shows how law 
enforcement found a vulnerability in the technology and was able to manipulate Tor’s 
normal action-object relationship. This adaptably is important; it shows that law 
enforcement stopped relying solely on traditional techniques and devised new means of 
overcoming criminal uses of Internet technology to counter hybrid crime. The final 
section provides conclusions about affordances vis-a-vis law enforcement adaptability. 
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A. HYBRID CRIMES GO MAINSTREAM: OPERATION ONYMOUS AND 

SILK ROAD 2.0 

After the Silk Road was seized and Ulbricht arrested, Internet anonymity 
affordanees became public knowledge. As a consequence, the prospect of committing 
hybrid crime became more inviting and creation of darknet marketplaces skyrocketed. 
This section describes how law enforcement responded to this surge of new darknet 
marketplaces, focusing particularly on Silk Road 2.0. The response included a global law 
enforcement operation called Operation Onymous. 

Operation Onymous involved the Department of Justice, FBI, HSI, DBA, and law 
enforcement from at least sixteen foreign countries.The operation’s results were 
staggering: they included seventeen arrests, $1.3 million in seized Bitcoins, and twenty- 
seven darknet marketplace seizures.Before they were seized, these marketplaces 
facilitated various hybrid crimes including the sale of “illegal narcotics, firearms, stolen 
credit card data and personal identification information, counterfeit currency, fake 
passports and other identification documents, and computer-hacking tools and 
services.Marketplaces that were seized as a result of the operation included: Alpaca; 
Black Market; Blue Sky; Bungee 54; Cabbabis UK; Cloud 9; Dedope; Farmerl; Hydra; 
Pablo Escobar Drugstore; Pandora-Pandora; Smokeables; Tor Bazaar; Fake Real Plastic; 
Pandora; Pay Pal Center; Real Cards Team-Team; The Green Machine; Zero Squad; 
Alpaca, Blue Sky; Fast Cash!; Sol’s Unified USD Counterfeit’s; Super Note Counter; 
The Hidden Market; Fake ID; Pandora, Silk Road 2.0; and Silk Road 2.0.While all 
these seizures were important, the Silk Road 2.0 provides the best comparisons relative to 
the original Silk Road. 
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Silk Road 2.0 was created just five weeks after the original Silk Road was seized. 
It came to life with a new operator and new URL, http://silkroad6ownowfk.onion, but 
with the same goal of eommitting eross-border hybrid erime.^^O silk Road 2.0 took over 
the role of faeilitating the sale of sueh items as illegal drugs, fake passports, fake driver’s 
lieenses, website hacking services, and email haeking tools. The same Internet 
affordanees Ulbricht pereeived—ineluding anonymous eommunieations and transaetions 
through Tor, Biteoin, and Biteoin tumbler—were employed onee again.1^2 However, Silk 
Road 2.0 plaeed a strong emphasis on proteeting its website servers’ anonymity, 
presumably based on the belief that Ulbricht was identified through forensie analysis of a 
server. The original Silk Road 2.0 operator, known as Dread Pirate Roberts 2 (DPR2), 
announeed in a forum to site vendors that “he had ‘taken steps the previous Dread Pirate 
Roberts wouldn’t have even thought of to proteet the servers that would run the new 
website. dPR 2 was never identified, but the new mindset of server proteetion earned 
forward to the next operator of the Silk Road 2.0. 

Around November 2013, shortly after Silk Road 2.0 was ereated, Blake Benthall 
(known online as “Defeon”), replaced DPR2 as the site operator. Benthall was twenty- 
six years old, originally from Houston, Texas, and reportedly grew up in a eonservative 
Christian household. He went to a Christian eollege ealled Florida College in Temple 
Terraee, Florida. Benthall moved to San Franeiseo, California, where he worked as a 
software developer and programmer for RPX, Carbon Five, and SpaeeX, and provided 
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freelance consulting to a startup company called Close.Similar to Ulbricht, Benthall’s 
libertarian ideals directed his actions to support an open market and the use of Bitcoin.l^^ 
Ulbricht and Benthall appeared to have very similar backgrounds, social networks, and 
ideals that may have allowed them to perceive divergent, and illegal, Internet technology 
uses. 

Like Ulbricht and DPR2, Benthall showed a desire to maintain and improve the 
Internet technologies that afforded him anonymity. Benthall seemed to focus the most 
concern, like DPR2, on website server vulnerabilities rather than on problems with Tor, 
Bitcoin, or Bitcoin tumbler technologies. In one forum post about the Silk Road 2.0 
Bitcoin payment system, Benthall announced that Silk Road 2.0 had “increased server 
anonymity.”1^9 another post he stated he was working “to expand our Bitcoin 
infrastructure’s ability to process more cash deposits per minute while preserving server 
anonymity and security.” 1^0 Benthall also posted a message to site administrators about 
protection of Silk Road 2.0 servers, stating, “Prevent[mg] servers from being seized by 
[law enforcement] ... this has been consuming most of my time and I cannot elaborate on 
it, nothing’s in danger, but scaling a site this large requires a lot of odd approaches to 
server stealth.”l8l It is apparent that Benthall believed law enforcement had identified 
Ulbricht based on weaknesses in anonymity afforded to website servers, and he was 
working to avoid the same fate. 

Another incident that contributed to BenthaU’s concern about website server 
anonymity occurred on July 30, 2014, as a result of a Tor Project public blog post. The 
Tor Project announced it had identified a group of relays that were placed within the Tor 


Price, “How Friends saw Blake Benthall”; Robert McMillan, “Alleged Silk Road 2 Mastermind 
Worked for Ex-Googler’s Secret Startup,” Wired, November 10, 2014, 

https://www.wired.com/2014/ll/alleged-silk-road-2-mastermind-worked-ex-googlers-secret-startup/. 

178 Price, “How Friends saw Blake Benthall.” 

United States v. Blake Benthall, Sealed Complaint, 15. 

180 Ibid. 

181 Ibid., 20. 


58 



network for purposes of eommitting traffie eonfirmation and Sybil attaoks.1^2 a traffie 
eonfirmation attaek is used to determine if relays are on the same cireuit, and a Sybil 
attaek is a way to subvert eommunieation flows in a peer-to-peer network by 
manipulating the assumed identities of relays.The relays eausing the attaeks were 
aetive within the Tor network from January 30, 2014, to July 4, 2014, and the Tor Projeet 
believed the attaeks were designed to de-anonymize users. At the time the Tor Projeet 
made the announeement, it was unknown who eommitted the attaeks or why. In response 
to the blog post, Benthall posted, “We are eonfident our unordinary servers are relatively 
safer than most hosting approaehes, but will be moving servers again today. ... We are 
provisioning the replaeements and not conneeting to possibly eompromised deviees.’’^^^ 
This network eompromise was the first sign that Tor, as a teehnology, might not be able 
to afford the level of anonymity pereeived by Ulbrieht. 

Despite the possible Tor vulnerabilities, Benthall sueeessfully operated the Silk 
Road 2.0 marketplaee and used its teehnologies to eommit the hybrid erime of smuggling 
from November 2013 to October 2014.The site offered 14,024 illegal drug sale 
listings, including heroin, cocaine, psychedelics, ecstasy, cannabis, and opioids.There 
were also fake passports, driver’s licenses, website hacking services, and email hacking 
offered for sale.^^^ The marketplace generated $8 million in illicit sales each month by 
internationally linking thousands of unlawful vendors with over a hundred thousand 
buyers.Territorial borders did not dissuade the smuggling, and the Internet 
affordances perceived by Ulbrieht supported BenthalTs objectives. However, BenthalTs 
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objectives were not the only ones at work: the stigmergic cycle had swayed, and law 
enforcement was attempting to gain an advantage over the technological innovations, 
seeking new ways to identify and stop darknet marketplaces. 

Even with Internet technologies affording anonymity, and the extra precautions to 
conceal servers, Benthall could not stop law enforcement from gathering evidence of 
criminal activity. Like the Silk Road investigation, law enforcement was able, again, to 
successfully gather evidence of criminal activity using traditional undercover and 
forensic analysis techniques. HSI had an undercover agent develop support staff access to 
the Silk Road 2.0 website in order to communicate directly with Benthall.190 agent 
was able to monitor Silk Road 2.0 website activity and compare it with communications 
received directly from Benthall. Additionally, the DEA conducted multiple undercover 
drug purchases online through the marketplace. 191 Advancing the investigation beyond 
gathering evidence, the FBI located and imaged a Silk Road 2.0 server found in a foreign 
country.192 Once the server was identified, law enforcement sought information from the 
service provider; the service provider produced the email address blake@benthall.net, 
which helped identify Benthall as the Silk Road 2.0’s operator.193 The FBI was able to 
identify multiple service alerts sent directly to the email address, which further linked 
Benthall to the Silk Road 2.0 server.194 To strengthen the connection, relevant IP address 
activity for the specific email address was linked to Benthall’s physical locations at 

known times. ^95 

The cooperative investigative efforts by FBI, HSI, and DEA developed enough 
probable cause to identify Benthall as the Silk Road 2.0 operator and issue a federal 
warrant for his arrest. U.S. law enforcement authorities arrested Benthall on November 5, 
2014, in San Francisco; he was charged with conspiracy to commit narcotics trafficking, 

^90 United States v. Blake Benthall, Sealed Complaint, 6. 

191 Ibid., 12. 

192 Ibid., 21. 

193 Ibid., 23. 

194 Ibid. 

195 Ibid., 24-25. 


60 




aiding and abetting computer hacking, transferring fraudulent identification documents, 
and money laundering. 1^6 He was brought to the Southern District of New York to face 
the criminal charges. In addition to Benthall’s arrest, the Silk Road 2.0 website was also 
seized. Benthall’s case has been continued numerous times and is still pending a final 
disposition. 

B. LAW ENFORCEMENT ADAPTABILITY FORCES ACTION-OBJECT 

RELATIONSHIP CHANGES 

The Benthall investigation is significant because it disclosed the technology and 
affordance similarities between the Silk Road and Silk Road 2.0. Although new 
techniques were not disclosed, the investigation highlighted which traditional law 
enforcement techniques were successful. Another investigation of Silk Road 2.0 
subordinate operator Brian Farrell (who went by the online pseudonym “DoctorClu”), 
provides insight into new techniques adopted by law enforcement. The following 
information about Farrell’s arrest shows how the stigmergic cycle was moved by law 
enforcement perceiving technology affordances to counter hybrid crime. 

Similar to the investigations surrounding Ulbricht and Benthall, law enforcement 
relied on traditional enforcement techniques such as undercover activity, search warrants, 
and forensic analysis of seized computer storage devices to identify and gather evidence 
against Farrell. Law enforcement discovered Farrell’s identity and location in Bellevue, 
Washington, based on an IP address that linked Farrell to the Silk Road 2.0 website. 
When agents located Farrell’s address they approached Farrell and his roommate for 
consensual interviews. 1^8 As a result of the interviews, law enforcement verified Farrell 
and his roommate were aware of the Silk Road 2.0 website and that Farrell had advanced 
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computer skills. 1^9 After gaining eooperation from the roommate, eonducting a seareh 
warrant, and seizing drugs and money, law enforeement interviewed Farrell again.200 
During this interview, when law enforeement asked Farrell to identify people involved in 
the Silk Road 2.0, he replied, “You’re not going to find much of a bigger fish than me ... 
My moniker on Silk Road was ‘DootorClu.’”^®! 

While this exehange does not disclose anything new about teehnology or 
affordanees, one matter diselosed in a seareh warrant affidavit eventually brought new 
investigative teehniques to light: how law enforcement identified Farrell’s IP address. In 
an affidavit written in support of establishing probable eause for a seareh warrant, an 
agent wrote that “an FBI ‘souree of information (SOI)’ provided ‘reliable IP addresses 
for TOR and hidden serviees sueh as SR 2.’”202 Additionally, the agent wrote, “The SOI 
also identified approximately 78 IP addresses that aceessed a vendor .onion address,” 
whieh led to Farrell’s IP address.203 Knowing that Farrell relied on Tor for anonymity, 
his defense eounsel wanted to know how agents identified Farrell’s IP address; the result 
was a baek-and-forth legal struggle between the prosecution and defense about how mueh 
information should be disclosed regarding investigative teehniques. 

In response to diseovery demands, the proseeution provided Farrell’s defense 
eounsel with a letter, whieh disclosed that Farrell was linked to Silk Road 2.0 “based on 
information obtained by a ‘university-based researeh institute’ that operated its own 
eomputers on the anonymous network used by Silk Road 2.0.”204 information was 
released publiely in an order on defendant’s motion to eompel further diseovery filed on 
February 23, 2016. Judge Riehard A. Jones notes in the order that Farrell’s “IP address 
was identified by the Software Engineering Institute (SEI) of Carnegie Mellon University 
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(CMU) when SEI was conducting research on the Tor network which was funded by the 
[Department of Defense].As part of this research, SEI was reportedly “operating 
nodes” on the Tor network.206 Judge Jones also disclosed the fact that the information 
about EarrelTs IP address was obtained for the investigation “pursuant to a subpoena 
served on SEI-CMU.”207 Research shows that CMU SEI was deemed a federally funded 
research and development center (EERDC) in 1984 to provide leadership and foster 
collaboration in the software and cyber communities.^OS 

Although Judge Jones denied a motion to compel specific technical information 
about how law enforcement identified EarrelTs IP address, and other government 
disclosures remain sealed, he required the prosecution to disclose general information 
about how the IP address was located. The court documents disclose that law 
enforcement, with help from CMU SEI, found a way to de-anonymize Tor.209 
revelation rendered Tor—trusted by Ulbricht, Benthall, and Earrell—no longer 
trustworthy. This is a significant disclosure because it shows how law enforcement 
adapted to Tor’s anonymity affordances and developed a method for manipulating its 
vulnerabilities. It also demonstrates how technically advanced the Internet has become: 
law enforcement had to seek outside expertise from CMU. 

Judge Jones’ order also reaffirmed a legal precedent relative to dark web privacy: 
although Tor is used for anonymity, its users’ privacy is not legally protected.^lO 
Specifically, Judge Jones found that, because Tor users have no reasonable legal 
expectation of privacy, law enforcement did not conduct a true “search” when it relied on 
SEI to locate EarrelTs IP address.^D The judge stated, “In order for a prospective user to 
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use the Tor network they must diselose information, ineluding their IP addresses, to 
unknown individuals running Tor nodes, so that their eommunieations ean be direeted 
toward their destinations. Under sueh a system, an individual would neeessarily be 
diselosing his identifying information to eomplete strangers.”212 The judge relied on the 
preeedent from United States v. Forrester and United States v. Miehaud to make his 
deeision. In United States v. Forrester, the eourt found no expeetation of privaey for IP 
addresses beeause they are “provided to and used by Internet serviee providers for the 
speeifie purpose of direeting the routing of information. ”213 In United States v Miehaud, 
“the eourt held that the IP address was publie information.”214 These findings ereated a 
legal preeedent: that there are no privaey proteetions for people trying to anonymize 
themselves using Tor. 

The Tor Projeet subsequently released a statement indieating that they believed 
SEI exeeuted traffie eonfirmation and Sybil attaeks on the Tor network to de-anonymize 
users.215 The projeet identified a group of suspieious relays loeated in the network 
between January 30, 2014 and July 4, 2014.216 A traffie eonfirmation attaek oeeurs, the 
Tor Projeet explained, by a user eontrolling or observing entry and exit relays on both 
ends of a Tor eireuit to eompare traffie timing, volume, or other eharaeteristies to 
determine whieh relays are on the same eireuit.2U An attaeker would then be eapable of 
matehing up IP addresses identified from the entry relay with the loeation the IP address 
was aeeessing from the exit relay.218 The end result is de-anonymized eommunieations. 
A Sybil attaek is a way to subvert eommunieation flows in a peer-to-peer network by 
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manipulating the assumed identities of relays.219 a malicious relay, or node, can 
illegitimately claim to have multiple identities by creating new identities or 
impersonating existing ones.^^O jor Project stated the SEI Sybil attack on the Tor 
network involved introducing 115 fast non-exit relays that acted as entry guards, routing 
a significant amount of Tor communications initially through those 115 relays.^^l This 
allowed the attacker to collect IP addresses and complete traffic confirmation analysis. 

The Tor Project’s assertions were never proven. It can logically be assumed that, 
because Farrell’s arrest and the seizure of Silk Road 2.0 were part of Operation 
Onymous, information from CMU SEI contributed to other law enforcement successes. 
What is known, based on the order from Judge Jones, is that law enforcement relied on 
information received from CMU SEI to identify Farrell’s IP address, even though his 
identity was anonymized by Tor, which led to his successful prosecution. On June 3, 
2016, Farrell entered a plea agreement and was found guilty of conspiracy to distribute 
cocaine, heroin, and methamphetamine; he was sentenced to ninety-six months 

incarceration.222 

C. CONCLUSIONS ABOUT SILK ROAD 2.0: AFFORDANCES LOSE 

The Silk Road 2.0 case study shows how hybrid crimes became more established 
by criminals as the criminals, in turn, became more accustomed to the Internet 
technologies. Benthall and Farrell believed the same Internet affordances used for the 
Silk Road would protect their anonymity while operating Silk Road 2.0. As shown by 
Operation Onymous, numerous other criminal actors operating in the dark web 
maintained the same Internet affordances originally perceived by Ulbricht. A 
proliferation of darknet marketplaces demonstrated an increased reliance on the dark 
web. Tor, Bitcoin, and Bitcoin tumblers to commit crime. 


219 Douceur, “The Sybil Attack.” 
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Of significance for this study is that, despite Benthall and Farrell having a basis to 
trust their Internet affordanees, as Ulbrieht did, law enforeement changed the game by 
overeoming Tor’s afforded anonymity. After investigating the Silk Road, law 
enforcement started perceiving certain Internet affordanees differently, and adapted to 
them; they also began to view hybrid erimes differently, and devised investigative 
teehniques outside of traditional methods. In essenee, law enforeement used adaptation to 
ehange an understood aetion-objeet relationship among Tor, anonymity, and hybrid 
erime. 

Part of this adaptation was federal investigators’ realization that Internet 
teehnologies had surpassed their knowledge, and were thus impeding their ability to 
investigate hybrid erimes. Agents also realized they had to broaden their approaeh to 
fight hybrid erimes by seeking teehnieal expertise outside of the law enforeement realm. 
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VI. CASE STUDY ANALYSIS AND FINDINGS 


The Web as I envisaged it, we have not seen it yet. The future is still so 
mueh bigger than the past. 

—Sir Tim Berners-Lee, inventor of the World Wide Web223 

The Silk Road and Silk Road 2.0 oases demonstrate the ohanging oategories of 
border-related orime. Both ease studies show orime’s physioal and digital elements and 
tangible results from Internet teohnologies’ action-objeot relationships. This chapter 
provides an analysis of hybrid crime based on data obtained from the case studies. The 
first section explains which initial research hypotheses are validated, invalidated, or 
inconclusive. The second section presents eight findings extrapolated from the case 
studies that illuminate the challenges law enforcement faces when countering the illegal 
movement of people and goods facilitated by the Internet. 

A. ANALYSIS: WHAT CAN BE LEARNED FROM THE SILK ROAD AND 
SILK ROAD 2.0? 

This study gathered data about the Silk Road and Silk Road 2.0 by analyzing 
available literature. The content helped identify the changing categorization of border- 
crime based on criminals’ increased reliance on Internet technologies. Part of the analysis 
involved examining how criminal actors traditionally commit border-related crimes, the 
investigative techniques law enforcement traditionally employ, how criminal actors use 
the Internet to commit criminal activity, how law enforcement identifies criminal activity 
facilitated by the Internet, what law enforcement can do to overcome the Internet’s 
unique affordances for border-related crimes, and the effectiveness of investigative 
techniques that can be used to enforce these crimes. Data has been synthesized to 
determine validity of the hypotheses and findings. 


“Tim Bemers-Lee Quotes,” AZ Quotes, aeeessed Deeember 6, 2017, www.azquotes.eom/author/ 
8668-Tim_Bemers_Lee?p=l. 
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I believed at the outset of this researeh that eriminal actors and law enforcement 
would have different Internet affordances pertaining to border-related crime; that 
hypothesis has been validated. Even though affordances are always present, people 
perceive them differently depending on their unique frameworks and constraints. 
Ulbricht, Benthall, and Farrell perceived an anonymity affordance from Tor, Bitcoin, and 
Bitcoin tumbler technologies, which allowed them to successfully create and operate the 
Silk Road and Silk Road 2.0. These darknet marketplaces existed for years and facilitated 
the smuggling of enormous cumulative quantities of illegal drugs into the United States, 
generating millions of dollars of illicit proceeds from Bitcoin transactions. Because 
Ulbricht, Benthall, and Farrell were able to perceive and actionize these affordances 
before law enforcement fully understood the technologies, they had the advantage. 

While the case studies show that criminals and law enforcement perceived and 
exploited different Internet affordances, they do not show a wide technology gap between 
the two groups, as I originally hypothesized. It took law enforcement approximately two 
years to investigate the Silk Road, arrest Ulbricht, and seize the website. During those 
two years, law enforcement successfully gathered evidence of Ulbricht’s illegal activities 
using traditional law enforcement techniques. Faw enforcement’s stumbling block was its 
inability to identify Ulbricht as the website operator due to the anonymity affordances 
from Tor, Bitcoin, and Bitcoin tumbler. Despite this immediate ability to “overcome” 
Tor, law enforcement eventually recognized vulnerabilities in this evolving hybrid crime 
category and identified Ulbricht using traditional law enforcement techniques. 

It took law enforcement approximately one year to investigate Silk Road 2.0; 
arrest Benthall, Farrell, and others; and seize the website. During that year, law 
enforcement gathered ample evidence to prosecute the operators, and assisted foreign law 
enforcement officials with the much larger Operation Onymous. It is not unusual for a 
large-scale federal criminal investigation to take a year or more to fully conclude. 
Significantly, during the period between investigations of the Silk Road and Silk Road 
2.0, law enforcement learned how to counter Tor’s anonymity affordance. 

Faw enforcement was able to evolve its understanding of Internet technologies, 

which suggests that there is not a large technological gap between criminals and law 
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enforcement; the differing Internet affordances are better explained by the stigmergic 
cycle. The data clearly show how criminals and law enforcement are constantly trying to 
gain an advantage over one another in the stigmergic cycle of law and order. However, it 
is still unknown if law enforcement is reacting to criminal technological advancements, 
or if criminals are reacting to strong law enforcement efforts (as illustrated by the 
chicken-or-egg dilemma described in Chapter III). Which group is leading the stigmergic 
cycle: law enforcement or criminals? The most accurate answer, according to the data 
analysis, is: both. The data clearly show a strong causal relationship between criminals 
and law enforcement; that relationship has caused both crime and investigative 
techniques to evolve and adapt. Such evolution created the hybrid category of border- 
related crime. The birth of the Silk Road and Silk Road 2.0, as well as law enforcement’s 
capacity to de-anonymize Tor, show adaptation at work, but do not show a large 
technological gap. 

This thesis also hypothesized that deterrence could not be achieved without 
narrowing the technological gap between law enforcement and criminals; this hypothesis 
was inconclusive. I predicted that if law enforcement relied on traditional investigative 
techniques, rather than realizing the same Internet affordances perceived by criminals, 
agents would not be able to achieve general deterrence of crime. The case studies show 
divergent results from traditional and non-traditional law enforcement techniques, but 
both ultimately resulted in specific deterrence through arrests and seizures. Although 
specific deterrence was achieved, the case study data do not reveal how different types of 
investigative efforts correlate to general deterrence. I discovered that law enforcement 
efforts created displacement from one darknet marketplace to another; however, general 
deterrence was not achieved from either conventional or unconventional investigative 
techniques. 

B. ANALYSIS AND FINDINGS 

Border-related crimes have traditionally been physical crimes. It is easy for most 
people to understand this type of drug trafficking: A narcotrafficker smuggles large 
quantities of drugs across a border into the United States. Once those drugs are in the 
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United States, they are divided into smaller amounts and distributed to different states, 
eities, and towns. Likewise, it is easy to understand how bulk cash is physically smuggled 
across the border in the reverse direction to pay the narcotrafficker. Save for telephone 
calls and some electronic money transfers, the traditional understanding of drug 
trafficking is physical. The case studies show how the evolution of drug trafficking from 
a physical to a hybrid crime has created unique challenges for law enforcement, including 
changing established understandings. The following section discusses my findings based 
on analysis of the case studies. 

1. Categories Matter for Criminal Typologies 

Law enforcement uses different techniques to investigate criminal activity 
facilitated by physical and digital objects—there are established techniques for 
investigating cybercrime, and established techniques for investigating physical crimes. 
Despite the crossover from physical to digital, each type of investigation remains 
mutually distinct. When criminal activity falls outside of known categories, like in the 
Silk Road investigation, difficulties arise. Although clear criminal labels are not always 
apparent, they are important. They form or substantiate opinions, and influence actions 
and reactions. Failing to recognize and properly label new categories of crime can lead to 
inefficient and ineffective investigative techniques. 

The Silk Road investigation shows how essential it is for law enforcement to 
recognize changing criminal typology, and how difficult it can be to do so in dynamic 
environments. Even though law enforcement recognized a divergent criminal smuggling 
method, the activity was not uniquely labeled as “hybrid.” Rather than bulk drugs being 
physically smuggled across the border, the Silk Road involved only personal-use 
quantities, sent through the U.S. Postal Service; this change distanced suppliers from the 
physical criminal activity, which made it more difficult for law enforcement to identify 
suppliers or to link all smuggling activity to one specific organization. The digital 
element of illicit payment—instead of physical cash or electronic transfers, the Silk Road 
used Bitcoins—also posed a difficulty, allowing the transactions to hide in the dark web. 
When law enforcement viewed this hybrid crime through a traditional lens, agents relied 
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on conventional investigative techniques that could not efficiently identify Ulbricht. 
When the Silk Road investigation eoncluded, however, law enforeement was able to get 
results from traditional techniques, essentially pounding a square peg into a round hole. 

2. Analytical Frameworks Require Adaptability 

Historically, criminal justice and eriminology studies have relied heavily on 
soeiologieal frameworks to understand deviant behavior. While sociologieal frameworks 
might be effective for analyzing deviance, they are not effective for advancing technical 
understanding of erime faeilitated by the Internet. Soeiologieal frameworks focus on 
macro-analyses to determine what causes devianee; analysis of this sort does little to 
explain hybrid erime or to predict how Internet teehnologies might afford future criminal 
activity. 

The Silk Road and Silk Road 2.0 case studies further demonstrate that traditional 
soeiologieal frameworks do not add value for law enforeement agents who are 
investigating hybrid crime. Ulbrieht and Benthall both had similar libertarian ideals, but 
also conservative religious upbringings that do not mateh normal drug trafficking 
indicators. Even if Ulbrieht and BenthalTs behavior eould be analyzed for faetors that 
eaused deviance, the resulting data would not help law enforcement ereate more effective 
enforcement strategies. A better practieal approach for law enforcement purposes is to 
analyze how Internet technologies facilitated the border-related crime. 

Rather than relying on physieal notions, Ulbrieht used Internet teehnologies to 
evolve erime, thus oreating hybrid erime. The emergenoe of hybrid erime demonstrates 
how essential it is to identify analytical frameworks that oan adapt to evolving 
environments. In the ease of hybrid erime, frameworks must adapt to oonsider new digital 
elements, yet must still maintain the capaoity to analyze physieal actions. This thesis 
relies on adaptable frameworks to analyze the Silk Road and Silk Road 2.0 investigations 
by intertwining affordance theory—originally designed to advance ecological 
psychology—and the coneept of stigmergy—originally designed to study ethology. When 
compared to conventional eriminal justice frameworks, affordance theory and stigmergy 


71 



have more effeetively analyzed dynamie environments relative to ehanging typologies 
and disruptive technologies. 

3. Not All Technologies Create Criminal Disruption ... at Least Not 
Immediately 

New technologies are known to disrupt various markets, but not all Internet 
technology innovations disrupt crime. For legitimate markets, technology causes 
disruption when it improves “functionality” and makes something “simpler, cheaper, and 
more reliable and convenient than mainstream products.Similarly, criminals are 
always looking for more efficient ways to commit border-related crime. For criminal 
markets, disruption can happen when Internet technologies significantly change the 
understood relationship between deviant behavior and criminal justice. As the case 
studies show, hybrid crime dramatically impacted this causal relationship and made 
enforcement of border-related crime more difficult. Hybrid crime was possible because of 
Tor, Bitcoin, and Bitcoin tumbler technologies, but not all of these technologies were 
disruptive. 

The anonymity afforded by Tor has been one of the more difficult challenges for 
law enforcement to overcome. However, Tor has been available to the public since 2004 
and did not become a challenge for law enforcement until 2011, when the Silk Road 
darknet market was launched.225 While anonymous communications can help actors 
conspire. Tor, by itself, could not transition the financial aspects of border-crime from a 
physical element to a digital one. Tor was not disruptive to crime by itself. The Internet 
technology that tipped the balance toward the causal relationship was Bitcoin. 

Bitcoin was the final technology needed for border crime to evolve. Its 
technology made anonymous financial transactions possible outside of the normal 
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banking establishment, whieh in turn allowed illicit money to be hidden in the dark web. 
Being decentralized, Bitcoin was difficult to track, and illicit monies could flow through 
the blockchain, transparent to law enforcement, without directly disclosing the buyer or 
collector’s identity. When Ulbricht realized Bitcoin’s capabilities, he viewed it in the 
context of other Internet signiflers to map his darknet market creation to completion. 
Bitcoin’s disruptive power was immediate when it was used as a criminal tool. Although 
Tor’s anonymity affordance has been the most difficult challenge for law enforcement, 
Bitcoin is what ultimately allowed the creation of darknet marketplaces, which in turn 
ultimately disrupted border crime and created hybrid crime. 

4. Collaboration Helps Overcome Challenges 

Investigating hybrid crime requires multiple perspectives and expertise. When 
investigating the Silk Road and Silk Road 2.0, law enforcement realized that 
collaboration was essential. No single law enforcement agency had all the expertise to 
successfully investigate border-related hybrid crime. The HSI and CBP had expertise in 
identifying, tracking, and seizing packages containing drugs. The IRS could effectively 
analyze complex evidence. The HSI and DBA knew how to conduct online undercover 
activity, and the FBI had the most technical expertise in investigating cybercrime. This 
shared expertise helped law enforcement overcome hybrid crime’s arising challenges. 

In addition to pooled domestic resources, foreign law enforcement collaboration 
also proved to be essential. For the Silk Road investigation, the FBI had to rely on foreign 
counterparts in Iceland to obtain an image of the Silk Road server that ultimately led to 
Ulbricht’s identification. Operation Onymous demonstrated even greater foreign 
collaboration, and exposed even vaster criminal globalization; at least sixteen foreign 
countries participated in the darknet marketplace enforcement action. As with the Silk 
Road investigation, the FBI relied on a foreign counterpart to image a Silk Road 2.0 
server that helped identify Benthall. Foreign law enforcement collaboration has proven 
essential to investigating hybrid crime. 
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5. “Outsourcing” Hybrid Crime Investigations 

Hybrid crime has surpassed enforeement by conventional investigative teehniques 
and has foreed law enforcement to seek help from outside technology experts. Despite 
extensive law enforcement eollaboration for both the Silk Road and Silk Road 2.0 
investigations, none of the law enforeement agencies had a panaeea for countering Tor. 
The Silk Road 2.0 ease study shows that law enforeement reeognized it laeked the 
technologieal ability to overcome Tor anonymity and sought help from CMU SET SEI 
had the teehnical capability needed to de-anonymize Tor, whieh allowed law enforcement 
to identify Earrell, and likely many other targets of Operation Onymous. A trend has 
emerged: law enforcement cannot fully investigate hybrid erime without outsoureing 
investigative elements to those who have unique teehnical expertise. 

SEI is one of forty-three EERDCs that are actively working on projects deemed 
important to the government.226 xhe projeets support both military and eivilian 
government agencies, including the Department of Homeland Seeurity. In addition to 
aeademie institutions like CMU, private corporations like RAND and MITRE are also 
involved in government EERDC projects.227 These projeets, and espeeially CMU SETs 
researeh on Tor, demonstrate that Internet teehnologies have outpaeed law enforcement’s 
teehnieal capabilities, and it may be required to outsouree investigations to fight hybrid 
erime. Since Internet teehnologies are constantly advancing, it is likely that outsoureing 
will be a eontinuing trend for law enforeement. 

6. Hybrid Crime Creates Unique Challenges but Has Unique 
Vulnerabilities 

Criminal evolution ehanges the law enforcement-criminal environment by 
ereating new challenges and offering different vulnerabilities. This thesis has already 
identified ehallenges that arise when physical criminal elements beeome digital: how Tor 
affords anonymity, how Biteoin makes illieit money diffieult to attribute, and how 


226 “Master Government List of Federally Funded R&D Centers,” National Seienee Foundation, 
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tumblers make it even more diffieult to trace funds. Despite these pernicious challenges 
for law enforcement, hybrid crime has also created its own vulnerabilities. The most 
significant vulnerability surfaces when a physical element becomes digital. 

Ulbricht and Benthall implemented Internet technologies handily to create darknet 
marketplaces, but left digital shadows on the Surface Web that law enforcement used to 
identify them. Both Ulbricht and Benthall left email address information attached to 
Internet servers operating marketplaces. Additionally, after Ulbricht integrated Tor, 
Bitcoin, and Bitcoin tumbler to make the Silk Road, he then had to entice drug vendors 
and consumers to the darknet marketplace. He did this by posting innocuous but directed 
messages in online forums on the Surface Web. This public marketing left traces of 
Ulbricht’s identity on the Surface Web that made it possible for law enforcement to link 
him to the Silk Road. 

7. Size Matters 

The size and growth of darknet marketplaces impact both criminal levels of risk 
and law enforcement prioritization. Darknet marketplaces are impacted differently by 
scalability than legitimate marketplaces. A legitimate marketplace usually requires 
growth to maintain market share and increase profit. Darknet marketplaces might realize 
greater profit and illicit market share from growth, but that benefit is counterbalanced by 
greater risk of arrest. The increased risk comes as a result of more exposure and 
becoming a more valuable target for law enforcement to pursue. 

The Silk Road’s growth highlights how risk grew for Ulbricht. When the Silk 
Road’s activity increased, Ulbricht could not fulfill all the operator demands by himself 
and had to consult and hire additional people to manage basic functions of the website. 
The growth also resulted in increasing numbers of vendors and buyers who participated 
in the market, none of whom he knew personally. Ulbricht had no way of knowing 
whether the people he was dealing with were “friends” of the darknet community, 
competitors wanting to take over the market, or undercover law enforcement agents. As 
the case study shows, Ulbricht was unaware some of the people he was dealing with were 
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undercover agents. It also shows those undercover agents successfully gathered evidence 
used to convict Ulbricht. 

The growth of the Silk Road and Silk Road 2.0 also directly caused law 
enforcement to pursue the criminal cases. Law enforcement believed that the bigger the 
marketplace became, the greater the risk it posed to society. Initially, when Ulbricht was 
facilitating small personal-use quantities of drugs shipped through the U.S. Postal 
Service, the matter was a low priority for federal law enforcement. Small seizures of 
personal-use drug quantities are not typically prosecuted federally without extenuating 
circumstances. When Ulbricht marketed the Silk Road on the Surface Web, he 
successfully increased his customer base; but in doing so he also attracted the attention of 
law enforcement and politicians. Benthall sums up the risk he took in scaling-up the Silk 
Road 2.0 best, stating, “I have no doubt that we have the highest traffic and therefore the 
highest [law enforcement] crosshairs on our foreheads. ... Purchases are going up, 
vendors are going up—and alongside this, the amount of personal risk staff is taking is 
exponentially going up. The bigger we become, the more resources agencies are willing 
to spend on hunting us. ”228 Benthall’s assessment of the environment was accurate; as 
the Silk Road 2.0 grew, it became a higher priority for law enforcement. 

8. Current Enforcement Efforts Are Not Deterring Darknet Markets 

Darknet markets have made it difficult for law enforcement to achieve specific 
deterrence, and general deterrence has not been achieved. Specific deterrence involves 
changing an individual’s behavior so he or she does not want to, or cannot, commit future 
crimes due to incarceration or other punishment. General deterrence, however, means 
changing group behaviors, causing larger criminal groups to realize the risks of crime are 
greater than the rewards. General deterrence can be the result of aggressive enforcement 
or a single case of specific deterrence (such as an individual criminal’s severe sentence) 
that dissuades others from wanting to commit the same criminal act. General deterrence 
is the ultimate goal for law enforcement because the overall benefit to society is less 
crime. Although law enforcement aims to achieve general deterrence for all types of 

228 United States v. Blake Benthall, Sealed Complaint, 16. 
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crimes, including border-related erimes, it does not always effectively do so. It has been 
especially challenging to foster general deterrence for border-related erimes faeilitated by 
the Internet. 

There have been various studies on law enforeement’s efforts to stop darknet 
marketplaces. These studies have eonsistently shown that after a large darknet 
marketplace is seized, use of darknet marketplaees immediately decreases. However, the 
decrease is only temporary; eventually, the users are displaced to other marketplaees. One 
study published in the International Journal of Cyber Criminology looked at the behavior 
of darknet market users and concluded enforeement displaeed eriminal aetivity, but did 
not signifieantly deter it.229 xhe authors of the study gathered data from eontent analysis 
of an online forum established immediately after the Silk Road marketplace was 
seized.230 Figure 5 shows conelusions drawn from the question; “Did the users still 
believe in the viability of Dark Net markets, after Silk Road olosure?”231 The results 
show that relatively few users were dissuaded altogether from using darknet 
marketplaces. 


229 Wesley Lacson and Beata Jones, “The 21st Century DarkNet Market: Lessons from the Fall of 
Silk Road,” International Journal of Cyber Criminology 10, no. 1 (January-June 2016): 52. 
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Figure 5. Darknet Market Displacement after Enforcement232 

A second study, published in the Crime Law and Social Change Journal, looks at 
the Agora, Cloud 9, Evolution, Hydra, and Silk Road 2.0 darknet marketplaces before 
and after three of the sites were seized during Operation Onymous.233 This study 
demonstrates the effect of darknet marketplace enforcement efforts by analyzing the 
supply and demand of drugs bought and sold in the dark web around the time period of 
Operation Onymous. The study concluded that the activity of buying and selling drugs 
was impacted by marketplace seizures, but drug prices were left unchanged. Additionally, 
even when activity was impacted by seizures, the effect was only temporary. Figure 6 
shows the number of active dealers on the five marketplaces before and after Operation 
Onymous as a way of demonstrating how the supply side was impacted by enforcement. 
This chart shows a drastic reduction in the number of dealers immediately after Hydra, 
Cloud 9, and Silk Road 2.0 sites were seized, but it also shows an eventual spike in dealer 
activity at Evolution. 

^32 Source: Lacson and Jones, “The 21st Century DarkNet Market,” 52. 

233 Decary-Hetu and Giommoni, “Police Crackdowns,” 66. 
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Figure 6. Supply-Side Impact of Darknet Market Enforcement234 

The same study viewed feedback loops as a way to determine how the demand 
side was impacted by Operation Onymous. Figure 7 shows how feedback loops were 
impacted after law enforcement seized the Cloud 9, Flydra, and Silk Road 2.0 sites. The 
study presumes the changes in feedback loops translate to the amount of illegal drugs 
being sold. Using this presumption, overall drug sales decreased for a short time after the 
seizures and then rebounded significantly when displaced to the Evolution marketplace. 


^34 Source: Decary-Hetu and Giommoni, “Police Crackdowns,” 66. 
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Figure 7. Demand-Side Impact of Darknet Market Enforcement235 

A third study, conducted at the National Drug and Alcohol Research Centre in 
New South Wales, Australia, shows darknet markets were impacted only temporarily by 
enforcement efforts.236 From October 2013 to November 2015, researchers gathered data 
from thirty-nine darknet markets that showed significant decreases in vendor activity 
after Operation Onymous, and then again after the Evolution site was closed from an exit 
scam. Figure 8 demonstrates vendor activity during three distinct periods. Period 1 starts 
when the Silk Road was seized and ends shortly after Operation Onymous. The second 
period begins shortly after Operation Onymous until the Evolution exit scam. The final 
period shows vendor activity after the Evolution marketplace closure. 


235 Decary-Hetu and Giommoni, “Police Crackdowns,” 69. 

236 Joe Van Buskirk et al., “The Recovery of Online Drug Markets Following Law Enforcement and 
other Disruptions,” Drug and Alcohol Dependence 173 (2017): 160, doi:10.1016/j.drugalcdep.2017.01.004. 
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Figure 8. Darknet Market Vendor Activity after Enforcement and Exit Scam237 

This chart shows drops in vendor activity after the Silk Road seizure, Operation 
Onymous, and Evolution closure. While these drops are dramatic, vendor activity 
continued to climb and, by the time the study concluded, was at near all-time activity 
highs. One point of interest is that the largest decrease of activity did not stem from 
enforcement efforts, but from a loss of trust when Evolution’s exit scam occurred. 
Displacement from other darknet marketplaces to Evolution may have contributed to this 
large decrease in activity.238 

These three studies demonstrate how difficult it is to deter criminal activity from 
darknet marketplaces. While specific deterrence has been shown against individual 
criminal actors and marketplaces, general deterrence has not been acheived. Enforcement 
efforts have been effective at temporarily decreasing and displacing criminal activity, but 
have not resulted in less criminal activity overall. Additionally, there is no indication that 
enforcement activity aimed at darknet marketplaces has displaced criminal activity from 

237 Source: Van Buskirk et al., “Recovery of Online Drug Markets,” 160. 

238 Buskirk et al., “Recovery of Online Drug Markets,” 160. 
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the digital realm back to the physical. This chapter’s three studies review darknet 
marketplace activity from the Silk Road through the time period immediately following 
the Evolution exit scam, which ended in November 2015. The next chapter concludes the 
discussion by showing the present state of hybrid crime and by providing 
recommendations for law enforcement based on the research findings. Recent cases show 
that the category of hybrid crime has become the staple of drug smuggling and that the 
intermixing of digital and physical elements is impacting other border-related crimes 
as well. 
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VII. PRESENT ENVIRONMENT, RECOMMENDATIONS, AND 
CONCLUSIONS EOR EUTURE RESEARCH 


Make no mistake, the forees of law and justiee faee a new ehallenge from 
the criminals and transnational criminal organizations who think they can 
commit their crimes with impunity using the dark net. The dark net is not 
a place to hide...I believe that because of this operation, the American 
people are safer-safer from the threat of identity fraud and malware, and 
safer from deadly drugs. 


—Attorney General Jeff Sessions239 
Regarding the arrest of Alexandre Gazes and seizure of AlphaBay 


Although law enforcement has been continuously investigating hybrid crimes and 
darknet markets since the Silk Road first emerged, the challenges from Internet 
technologies used to facilitate cross-border crime have not been curtailed. Recent arrests 
show that hybrid crime has become the new standard for drug trafficking, and darknet 
markets have become an international dilemma. Cross-border crimes like child sexual 
exploitation and money laundering are also directly impacted by the shifting balance 
between physical and digital crime elements. This chapter explains the present status of 
hybrid crime and recommends law enforcement tactics that can counter present and 
future challenges. The first section of this chapter identifies and briefly describes some of 
the most recent cases involving hybrid crime, contextualizing why those cases are of 
interest to this study. The second section provides law enforcement and criminal justice 
professionals with short-, medium-, and long-term recommendations for managing the 
challenges of hybrid crime. The final section introduces avenues for future research that 
may advance the study of upcoming challenges. 

A. PRESENT STATUS OF HYBRID CRIME 

As crimes continue to evolve and include more digital elements, law enforcement 
has also been adapting its strategies. This evolution-adaptation response is a perfect 

239 “AlphaBay, the Largest Online ‘Dark Market’ Shut Down,” Department of Justiee, July 20, 2017, 
https://www.justice.gov/opa/pr/alphabay-largest-online-dark-market-shut-down. 
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example of the stigmergie eyele in aetion, and shows the eontinuing dynamie relationship 
between law enforeement and eriminals. The following ease examples not only show this 
evolution and adaptation, but also illustrate several of the findings noted in Chapter VI. 
The examples highlight eollaboration, enforeement efforts aimed at hybrid erime 
vulnerabilities, eryptoeurreneies as disruptive teehnology, and the neeessity to 
ineorporate non-law enforeement teehnology expertise into hybrid erime investigations. 

1. Operation Hyperion 

Operation Hyperion was a global law enforeement effort involving HSI, CBP, 
FBI, DBA, and more than nine foreign eounterparts, ineluding law enforeement from 
Australia, New Zealand, Canada, and the United Kingdom.240 Law enforeement went on 
the offensive from Oetober 22, 2016 to Oetober 28, 2016, by identifying vendors and 
buyers of drugs hidden in the dark web. 241 CBP and HSI foeused efforts on interdieting 
mail shipments eontaining illegal goods.242 The FBI interviewed over 150 individuals 
suspeeted of reeeiving mail shipments of illegal goods.243 Beeause the operation foeused 
on warning people about the dangers of darknet markets for illegal aetivity, rather than on 
enforeement, there were no reports of domestie arrests or seizures.244 Although U.S. law 
enforeement did not report substantial results, foreign governments substantiated that the 
goal of the operation was to provide a warning about darknet marketplaees. 

During the operation, law enforeement tried to dissuade the publie from using 
darknet markets by proving they eould not be trusted. Law enforeement demonstrated— 
and publieized—that enforeement ageneies eould identify presumably “anonymous” 
individuals operating on the dark web. The Duteh National Proseeution Serviee and 

240 “Law Enforcement Agencies around the World Collaborate on International Darknet Marketplace 
Enforcement Operatiorr,” ICE, accessed October 29, 2017, https://www.ice.gov/news/releases/law- 
enforcement-agencies-around-world-collaborate-intemational-darknet-marketplace. 

241 Ibid. 

242 Joseph Cox, ‘“Operation Hyperion’ Targets Suspected Dark Web Users around the World,” 
Motherboard, November 03, 2016, https://motherboard.vice.com/en_us/article/z438d8/operation-hyperion- 
targets-suspected-dark-web-users-around-the-world. 

243 Ibid. 
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Dutch police posted the online identities of a large number of vendors selling illegal 
drugs, as well as buyers who had already been arrested on a dark website created by the 
government.245 Swedish poliee “elaimed to have identified some 3,000 suspeeted 
buyers,” initiated 176 investigations, and detained several people in eonneetion with 
darknet market drug smuggling.246 New Zealand police interviewed 160 people and the 
Royal Canadian Mounted Poliee arrested a person suspeeted of nareoties traffiokmg.247 
While none of these results demonstrate signilieant enforeement aetions, they show 
international law enforeement eollaboration undermining the trust of darknet 
marketplaees. While Operation Hyperion can be viewed as a law enforeement strategy to 
deter hybrid crime, it may also be seen as a prelude to the take-downs of AlphaBay and 
Hansa. 

Operation Hyperion is important beeause it demonstrates law enforeement efforts 
aimed at influeneing media dependeney, as explained by media dependency theory, and 
shows a recognition that domestic and worldwide law enforeement eollaboration is 
required to eounter hybrid erime. 

2. AlphaBay 

AlphaBay was the largest darknet marketplace in history; its operators and users 
demonstrated eontinued use of Internet teehnologies to facilitate border-related erime. 
AlphaBay was a law enforeement priority beeause of its seale, but also beeause it was 
faeilitating the sale of fentanyl, whieh was eausing overdose deaths.248 The investigation 


245 Sarah Jamie Lewis, “Operation Hyperion: Netherlands Law Enforeement Troll Dark Market 
Vendors,” Mascherari Press, Mareh 27, 2017, https://maseherari.press/operation-hyperion-netherlands- 
law-enforeement-troll-dark-market-buyers/. 

246 Cox, “Operation Hyperion”; Benjamin Vitaris, “176 Investigations Started in Sweden, Operation 
Hyperion,” Deep Dot Web, January 9, 2017, https://www.deepdotweb.eom/2017/01/06/176-investigations- 
started-norway-operation-hyperion/. 

247 Cox, “Operation Hyperion.” 

248 Nathaniel Popper, “Opioid Dealers Embraee the Dark Web to Send Deadly Drugs by Mail,” New 
York Times, June 10, 2017, https://www.nytimes.eom/2017/06/10/business/dealbook/opioid-dark-web- 
drug-overdose.html. 
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was primarily conducted by the FBI and DBA under an operation named Bayonet.249 xhe 
IRS, HSI, and multiple international partners assisted with the investigation.250 xhe 
investigation revealed the marketplace was operated by a Canadian citizen named 
Alexandre Cazes, also known by the online pseudonym ALPHA02.251 AlphaBay linked 
40,000 vendors to over 200,000 users and had over 250,000 listings for illegal drugs.252 
Even though AlphaBay was vastly larger than the Silk Road and Silk Road 2.0, Cazes 
relied on the same Internet technologies. Tor and Bitcoin, to maintain anonymity.253 
Unlike the Silk Road, AlphaBay also aecepted the newer cryptocurrencies of Monero and 

Ethereum for illicit transactions.254 

AlphaBay operated from December 2014 until July 2017, when the marketplace 
was seized and Cazes arrested in Thailand.255 Like Ulbricht, Cazes was identified due to 
difficulties he encountered when transitioning a physical crime into a hybrid crime. 
While the technologies maintained anonymity, Cazes was reportedly identified from 
digital shadows; his personal Hotmail email address was discovered in the header of 
AlphaBay welcome and password recovery emails.256 Cazes was not ultimately 
prosecuted; shortly after arrest he committed suicide in a Bangkok, Thailand, jail.257 in 
addition to Cazes’ arrest, law enforcement seized millions of dollars of cyptocurrency 


249 “Massive Blow to Criminal Dark Web Aetivities after Globally Coordinated Operation,” Europol, 
July 20, 2017, https://www.europol.europa.eu/newsroom/news/massive-blow-to-eriminal-dark-web- 
aetivities-after-globally-eoordinated-operation. 

250 “AlphaBay, the Largest Online ‘Dark Market,’ Shut Down,” U.S. Department of Justiee, July 20, 
2017, https://www.justiee.gov/opa/pr/alphabay-largest-online-dark-market-shut-down. 
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255 Andrea Bellemare, “The Seeret Life of Alexandre Cazes, Alleged Dark Web Mastermind,” CBC 
News, August 16, 2017, http://www.ebe.ea/news/eanada/montreal/alexandre-eazes-milhonaire-ears- 
property-alphabay-1.4215894. 
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257 Andrew Blake, “Suspeeted AlphaBay Operator Found Dead in Thai Jail Cell Awaiting 
Extradition,” Washington Times, July 14, 2017, https://www.washingtontimes.eom/news/2017/juF14/ 
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and servers in Canada and the Netherlands.258 The seizure of the website immediately 
eaused eriminal displaeement from AlphaBay to Hansa.259 

The reeent takedown of AlphaBay is of interest to this study for three reasons. 
First, this ease demonstrates how inereased sealability made AlphaBay a prioritized target 
for law enforeement efforts. Seeond, beeause law enforeement identified the operator of 
AlphaBay by traeking his digital shadow, this ease highlights the pervasiveness of the 
vulnerability posed to hybrid erimes when physieal eriminal elements are transitioned to 
digital eounterparts. Third, the elosure of AlphaBay was not met with general deterrenee, 
but instead resulted in displaeement to the Hansa darknet market. While this reaetion 
supports the finding that general deterrenee is not being aehieved, displaeement in this 
ease is even more important beeause it was used as part of a law enforeement strategy, as 
explained in the following seetion. 

3. Hansa 

The Hansa investigation was led by the Duteh poliee, with support from 
Europol.260 Hansa was found to be operated by two German nationals using servers in 
the Netherlands, Germany, and Lithuania.261 Unlike AlphaBay, the Hansa operators tried 
to make their darknet marketplaee less of a priority for law enforeement by forbidding the 
sale of fentanyl, but its large seale still attraeted law enforeement’s attention. The most 
eompelling aspeet of the Hansa investigation was how the Duteh poliee turned the 
marketplaee into a honeypot to traek and identify users being displaeed from the seizure 

of AlphaBay.262 

The Duteh poliee eovertly operated Hansa for one month, ineluding two weeks 
immediately following the seizure of AlphaBay, to monitor and reeord user movements 


258 Europol, “Massive Blow to Criminal Dark Web Aetivities.” 

259 Blake, “Suspeeted AlphaBay Operator Found Dead.” 
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from one marketplace to the other .263 Hansa saw “an eight-fold increase ... recorded 
immediately following the shutdown of AlphaBay.”264 xhe honeypot strategy generated 
approximately 10,000 leads against drug buyers, which were provided to Europol.265 The 
Dutch police officially closed the Hansa marketplace on July 20, 2017.266 

As with the Silk Road 2.0 investigation, law enforcement investigating Hansa 
obtained technological expertise from non-law enforcement sources; the Dutch police 
and Europol relied on a company named Bitdefender.267 Bitdefender is a private Internet 
security company headquartered in Romania that provides cybersecurity protections to 
over 500 million users around the world.268 European authorities relied on Bitdefender to 
“compile the technical evidence that led to the shutdown of Hansa.”269 This is another 
example of how technological complexities used to facilitate hybrid crime require 
outsourced law enforcement response. 

In addition to showing global collaboration, the Hansa investigation exemplifies 
how law enforcement can adapts its investigative techniques—investigators successfully 
turned the darknet marketplace into a honeypot and outsourced technical investigative 
components to overcome the challenges presented by hybrid crime. 

4. BTC-e Money Laundering 

Alexander Vinnik, a thirty-seven-year-old Russian national, was arrested in 
Greece on July 25, 2017, on a twenty-one-count indictment issued from the Northern 


263 Ibid. 

264 Ibid. 
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District of Califomia.^^O Vinnik was charged with multiple erimes, ineluding 
international money laundering and operating an unlieensed money serviee business.271 
Vinnik’s arrest was the eulmination of investigative efforts by the IRS, HSI, FBI, Secret 
Service, Federal Deposit Insuranee Corporation, and Financial Crimes Enforcement 
Network (FinCEN).272 Starting in 2011, Vinnik allegedly laundered over $4 billion in 
Bitcoins through a digital eurrency exehange eompany he operated ealled BTC-e.273 in 
addition to Biteoin, BTC-e exchanged liteeoin, ethers, worldcoin, dogeeoin, and fiat 
eurreneies.274 Vinnik’s money laundering serviee made it possible for eriminals to make 
eybererime luerative; available serviees ranged from “eomputer haeking, to fraud, 
identity theft, tax refund fraud sehemes, public corruption, and drug trafficking.”275 xhe 
BTC-e exehange serviee was designed to allow physical and digital elements to be 
segmented and kept anonymous. A BTC-e user would not have to provide any personal 
information to open an aeeount, but also could not wire money direetly into BTC-e.276 
Money had to first be wired to a shell eompany and then converted into eryptoeurrency 
before it was transferred into BTC-e, forming a separation between an individual’s 
identity and BTC-e’s anonymity.277 

Vinnik maintained shell eompanies in Singapore, the British Virgin Islands, 
Eranee, and New Zealand.278 He had eustomers worldwide, ineluding in the United 
States. Two U.S. eustomers were direetly linked to the original Silk Road investigation; 
DEA Agent Carl Mark Eorce and Seeret Serviee Agent Shaun Bridges laundered 

270 “Russian National and Biteoin Exchange Charged In 21-Count Indictment for Operating Alleged 
International Money Laundering Scheme and Allegedly Laundering Funds from Flack of Mt. Gox,” U.S. 
Department of Justice, July 26, 2017, https://www.justice.gov/usao-ndca/pr/russian-national-and-bitcoin- 
exchange-charged-21 -count-indictment-operating-alleged. 
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272 Department of Justice, “Russian National and Biteoin Exchange.” 

273 Ibid. 

274 United States v BTC-E, A/K/A Canton Business Corporation and Alexander Vinnik, Superseding 
Indictment, Case #CR16-00227 SI (ND CA, January 17, 2017), 3. 
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hundreds of thousands of dollars in stolen Biteoin through BTC-e.279 Both agents worked 
on the Baltimore Silk Road Task Foree and stole large amounts of Biteoin from the Silk 
Road through eorrupt aetspor their illegal aets, Foree and Bridges were eonvieted of 
various finaneial-related eharges and will remain ineareerated until 2022.281 Vinnik, 
unlike Foree and Bridges, has not yet been proseeuted and is eontesting extradition to the 
United States.282 ppe ease against Vinnik is the largest money laundering investigation 
of its kind and exemplifies the eontinuing disruptive power that eryptoeurreney 
teehnology has on border-related erime. 

The BTC-e ease shows that money laundering is no longer a physieal erime based 
on bulk eash smuggling or wire transfers. Cryptoeurreneies are disrupting the eriminal 
environment and previously understood notions of money laundering. As a result, hybrid 
erime is beginning to evolve the border erime of international money laundering just as it 
evolved drug traffieking. 

5. Human Trafficking and Sexual Exploitation 

In addition to analyzing the Internet-related evolution of drug traffieking and 
money laundering, this thesis also reviewed how human traffieking and sexual 
exploitation are faeilitated by Internet teehnologies. Researeh indieates that eriminals 
have used Tor and Biteoin to anonymize transfers of sexually explieit videos, 
photographs, and live streams, but not to faeilitate border-related human traffieking.283 it 
appears to be a more eommon trend for faeilitators of domestie prostitution—but not 
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those of transnational human trafficking—to rely on Internet technologies like Tor .284 
Since human trafficking was not found to be significantly facilitated by Internet 
technologies, it appears to remain more a physical than hybrid crime. 

Even though the various elements of transferring sexually explicit videos, 
photographs, and live streaming may include digital and physical elements, and have a 
border nexus, these types of crimes are traditionally classified as cybercrimes. As 
mentioned previously, classifying crime is not easy and there are many variables. 
Whether a crime is categorized as hybrid instead of cyber would depend on the level of 
physical movement of people or goods. Despite sexual exploitation cases not neatly 
fitting into the label of hybrid crime, some were found to rely on affordances from Tor 
and BitTorrent. Others are not as sophisticated and rely on simple Internet access. In 
impoverished countries like the Philippines, expanded access to the Internet has sparked 
an explosion of cybersex dens as a way to generate income.285 These cybersex dens are 
producing live streams of young children being sexually abused for paying pedophiles in 
places like the United States, Australia, and Europe.286 

The HSI and EBI have assisted law enforcement in the Philippines with 
investigations of numerous child sexual abuse cases conducted at the hands of family 
members, other Philippine nationals, and foreign nationals. The abuse is recorded and 
streamed online in videos to paying pedophiles. Some instances include: 

• In July 2013, HSI assisted Philippine authorities with investigating, 
locating, and arresting Maybel Oranga, Bryan Sagmit, and Christian 
Chameco for running a cybersex den in Malabania, Angeles City, 


284 DARPA’s MEMEX program has been used to help gather evidenee from the dark web for state 
proseeutions of sex traffieking for the New York Distriet Attorney’s offiee; Larry Greenemeier, “Human 
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Pampanga .287 Three female victims, ages fifteen, sixteen, and seventeen 

were rescued.288 

• In September 2013, HSI assisted Philippine authorities with investigating, 
locating, and arresting Maricel Ayad and Dinesio Encallado Inoc for 
operating a webcam sex tourism operation in Cordova, Cebu.289 Three 
female victims, ages two, nine, and eleven, were rescued.290 

• In April 2017, the FBI assisted Philippines authorities in the city of 
Mabalacat with arresting U.S. citizen David Timothy Deakin for abusing 
children and operating a cybersex den.291 He relied on Tor, BitTorrent, 
and live streaming to operate webcam sex tourism.292 Deakin has been 
charged with cybercrime, child pornography, child abuse, and child 

traffickmg.293 

These cases show the present status of border-related sexual exploitation crimes 
facilitated by the Internet. Although the crime is appropriately categorized as a 
cybercrime, the crimes could be adapted to fit the hybrid mold. For instance, a pedophile 
may use Internet technologies to locate images of sexual exploitation, and then follow 
those images by physically traveling to a foreign country to engage in illicit sexual 
conduct. The act of physically traveling to facilitate the crime would change the balance 
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of physical and digital elements; the erime would then more appropriately be elassified in 
the hybrid eategory. 


B. RECOMMENDATIONS 

This study set out to answer a deseriptive question, yet the overall goal was to 
explore unique ways of viewing, understanding, and fighting erime. To that end, this 
seetion provides preseriptive reeommendations meant to improve investigative strategies 
for law enforeement and to advanee the study of eriminal justiee. For ease of 
implementation and adaptability, the reeommendations are divided into short-, medium-, 
and long-term strategie goals. While portions of the strategies are based in theory, they 
are not meant to be lost in theoretieal diseussions; they should be used for praetieal 
applieations to fight erime. The following strategies are derived from and foeus on hybrid 
erime, but ean be applied to other types and eategories of erime. 

1. Short-Term Strategy Recommendations 

Short-term strategy reeommendations are aimed at overeoming the immediate 
ehallenges presented by border-related erimes faeilitated by Internet teehnologies. The 
reeommendations are designed speeifieally to help law enforeement praetitioners 
understand and manage the eurrent dynamie environment. This strategy eould be 
eonsidered reaetive beeause it is aimed at maintaining law enforeement’s eurrent position 
within the stigmergie eyele rather than trying to ehange the law enforeement-eriminal 
balanee. The four reeommendations in the short-term strategy build upon one another: 
teehnology training, emphasis on properly elassifying erime, smart enforeement, and 
government eollaboration. 

a. Technology Training 

To understand the hybrid eriminal environment, investigators must first learn 
about related teehnologies that may faeilitate erime. As erime evolves and more elements 
beeome digital, mindsets must ehange; training previously reserved for investigators of 
eybererimes must be provided to all investigators. Tor, Biteoin, Biteoin tumblers, peer-to- 
peer networks, eneryption systems, and BitTorrent are just some of the teehnologies 
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investigators must understand if they are to simply reeognize when erimes are being 
facilitated by technology. Once a baseline understanding of technology is achieved, law 
enforcement can then focus on effective responses. One of the most significant results of 
understanding technology and recognizing crime facilitated by that technology is being 
able to properly classify crime. 

b. Classifying Crime 

Properly classifying crime is the second recommendation for the short-term 
strategy and extremely important for determining responses, strategy, techniques, and 
analysis processes. While classifying a crime is not always an easy undertaking, it is 
essential that law enforcement considers labeling a part of the investigative process. The 
purpose of classifying is not to “pigeon-hole” a crime into a category for bureaucratic 
documentation and simplification; it is actually the reverse. The purpose of thinking 
about criminal categories is to open investigators’ minds about evolving crime, new 
possible categories, and overall criminal typology. Whether a crime is labeled physical, 
cyber, or hybrid will help determine the type of investigative strategy used to respond or 
the type of expertise needed for support. Similarly, determining whether a deviant act is 
labeled drug smuggling, human trafficking/sexual exploitation, or money laundering will 
help determine the type of investigative techniques employed. While all investigations 
and crimes may have similarities or overlap, subtle differences are important. If a crime is 
properly labeled, law enforcement can focus on the established strategies and techniques 
that most effectively and efficiently counter that particular crime. As a secondary but 
equally important matter, proper labeling will also enable holistic analysis performed 
through sociological or technological frameworks. 

c. Smart Enforcement 

The third recommendation, after properly labeling crime, is to develop and 
employ smart enforcement techniques. Smart enforcement techniques involve a 
combination of traditional and unconventional techniques to overcoming many of the 
hybrid crime challenges. As an example, traditional techniques do not effectively uncover 
a suspect’s identity when it is anonymized by Internet technologies, but are still effective 
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when employed against the vulnerability that oceurs when physical crime elements 
become digital. When the elements are transitioning, investigators can search for digital 
shadows on the Surface Web to help identify an anonymized suspect in the dark web. In 
addition to using traditional techniques, law enforcement should always seek 
unconventional methods to de-anonymize Tor and capitalize on the legal precedent that 
anonymizing software is not afforded privacy protections. 

d. Government Collaboration 

The fourth short-term recommendation is to advance law enforcement 
collaboration. Globalization of crime has made it essential to work investigations across 
multiple jurisdictions and borders. Collaboration is no longer an option, but an 
investigative necessity. Additionally, as law enforcement agencies learn to adapt 
techniques to counter hybrid crime, cooperative efforts are one of the best ways to 
immediately overcome hybrid crime challenges. No one agency has all the tools for 
success, but cumulative expertise between local, state, federal, and international agencies 
leverages investigative strengths. 

2. Medium-Term Strategy Recommendations 

The medium-term strategy should begin after law enforcement has made 
successful progress toward implementing the short-term strategy items. 
Recommendations for medium-term strategy are intended to complement and advance 
the short-term strategy by transitioning law enforcement from a reactive to proactive 
posture. In terms of the stigmergic cycle, this strategy would make it so law enforcement 
is pushing the cycle instead of being pushed by it. In other words, by maintaining a 
proactive posture, law enforcement might have more influence over self-organization of 
the decentralized law enforcement-criminal environment. The medium-term strategy 
recommendations include building on law enforcement collaboration by engaging 
public-private partnerships and refining the smart enforcement strategy to focus more 
efforts on general deterrence. This medium-term strategy is primarily implemented by 
law enforcement practitioners, agency heads, and other government decision makers. 
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a. Public-Private Partnerships 

The first middle-term recommendation is to expand collaboration beyond the law 
enforcement community by creating public-private partnerships. This type of 
collaboration is essential to managing the technological advancements used to commit 
crime. Similar to the DOD’s partnership with CMU SEI, EuropoTs partnership with 
Bitdefender, and DARPA’s use of various academic institutions to advance the MEMEX 
program, the Department of Justice and Department of Homeland Security should 
establish their own EERDC designed to research the future technological evolution of 
crime.294 This type of collaboration would provide the needed support to advance law 
enforcement’s understanding of technology faster than criminal adaptations. Without 
such a public-private partnership, future Internet technology adaptations will likely 
afford new criminal methods and diminish law enforcement’s capacity to investigate 
crime. If this were to occur, law enforcement would regress in the stigmergic cycle and 
no longer maintain a proactive enforcement posture. 

b. Smart Enforcement (Phase 2) 

The second recommendation is to advance the smart enforcement technique 
beyond the short-term recommendations and modify it to achieve general deterrence. 
General deterrence against darknet marketplaces has not been achieved in the past by 
arrests and seizures alone, but is possible through an aggressive strategy aimed at 
diminishing the public’s trust in these marketplaces. As noted in Chapter III, media 
dependency theory explains how social network acceptance has created a level of social 
trust for darknet markets. If law enforcement can diminish trust in the markets, the public 
may be deterred from using them. The tactical elements to diminish trust include: seizing 
cryptocurrencies from marketplaces in a way that makes it appear the money was stolen, 
using website attacks to cause site failures, and initiating publicity campaigns appearing 
to come from within forum communities that generate concerns over site security, 
operator trustworthiness, and anonymity protections. 
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The collapse of the darknet marketplace Evolution exemplifies how this strategy 
will work. Evolution facilitated an estimated 475,000 transactions a year worth over $52 
million.295 it also had over 28,000 users connected to its social forum.296 in March 2014, 
Evolution’s unidentified operators initiated an exit-scam by shutting down the website 
and stealing approximately $12 million in customer funds.297 The exit-scam resulted in a 
larger decrease of illicit vendor activity than all the law enforcement actions of Operation 
Onymous.298 in essence, this law enforcement strategy is an attempt to achieve general 
deterrence by implementing law enforcement-sponsored exit scams. 

3. Long-Term Strategy Recommendation 

Eong-term recommendations complement both the short- and medium-term 
strategies by building sustainability. These recommendations could be implemented at 
any stage of progress within the other two strategies, but should be viewed as long-term 
processes from the beginning. This level of strategy is important for law enforcement 
practitioners, agency heads, oversight committees, academia, think tanks, and anyone 
else studying criminal justice to consider. The long-term strategy recommendations 
include building a law enforcement mindset that technology is “one with crime” and 
incorporating unconventional frameworks to analyze crime. 

a. Technology Mindset 

Building a mindset that technology is “one with crime” is essential to 
investigating both present and future crimes. Providing training to agents, officers, and 
investigators is only the first step toward building the mindset. Training needs to be 
followed by access to technological tools. Computer forensic analysis is no longer a 
specialty; a certain level of forensic knowledge is required for all investigations. 
Specialty software designed to gather and analyze evidence should be prevalent. 

295 Thomas Fox-Brewster, “A $50m Dmg and Gun Dark Web Market Just Disappeared and Millions 
in Biteoin with It,” Forbes, Mareh 23, 2015, https://www.forbes.eom/sites/thomasbrewster/2015/03/18/ 
evolution-market-a-seam-says-site-pr/#5f23f90d780f 

296 Ibid. 

297 Joe Van Buskirk et ah, “Online Dmg Markets,” 160. 

298 Ibid. 
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Platforms for conducting online undercover aetivity should be established and ready to 
use. Polieies and proeedures for using oryptoeurreneies as an investigative tool should be 
simple and supported. Tor should not be a mystery or something to fear aeeessing. While 
training is extremely benefieial, a teehnology mindset eannot be built if tools are not 
provided 

The next step toward building a one-with-erime teehnology mindset is for 
ageneies to implement future studies into present and future strategies. Agents, offieers, 
and investigators should be taught the basie approaehes of future studies; though they do 
not all need to beeome futurists, they should advanee the mindset. The reaetive praetiee 
of identifying new teehnologies only after those teehnologies stymie investigative 
progress should end. Ageney heads should start hiring trained futurists, speeifieally to 
researeh teehnology and erime. Their job would be to pereeive new affordanees ahead of 
eriminals. A futurist would also be able to assess whieh teehnologies eould potentially be 
disruptive to the law enforeement-eriminal environment, distinguishing them from 
teehnologies that are new, but manageable. The goal would be to identify potential 
teehnologieal ehallenges early in the eyele so researeh taskings ean be referred to 
FFRDCs to develop tools before they are needed. 

b. Frameworks 

The final reeommendation for the long-term strategy is to use uneonventional 
frameworks to analyze erime. New frameworks, outside the traditional soeiologieal 
sphere, must be ineluded into the study of eriminal justiee to analyze teehnology’s ever- 
ehanging role in erime. The frameworks need to be adaptable for the dynamie 
environment and direetly applieable to law enforeement. Affordanee theory and the 
eoneept of stigmergy are reeommended for this strategy beeause, rather than simply 
predieting deviant behavior, they ean help law enforeement understand the tools that may 
be used for deviant behavior. Gaining an understanding of objeets (teehnologies) and 
what those objeets ean do for erime (affordanees) is immediately important for the fight 
against erime. 
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These short-, medium-, and long-term strategy reeommendations are a starting 
point; they ean begin to help law enforcement better manage the dynamic environment of 
technology and crime. While these strategies are intended for border-related crime they 
may serve as a roadmap for many other criminal focuses. Despite touching on theory and 
sociological concepts, this strategy is not intended to advance the study of criminology by 
determining causes of deviant behavior. Instead, it is intended to support the study of 
criminal justice by providing immediate practical benefits for law enforcement. 

C. CONCLUSION AND FUTURE RESEARCH 

The Internet is going to grow in size, capability, and use. The Internet of things is 
expected to raise the number of devices connected to the Internet to 25 billion by 
2020.299 Currently, 3.8 billion people across the globe have Internet access; however, the 
United Nations is pursuing “universal affordable Internet access” as a means for global 
economic improvement, which will increase Internet access to the third world.^OO If 
Moore’s law holds true for the future, as it has for the last fifty years, computing power 
will double every two years.201 These three facts alone suggest that innovation in the 
field of Internet technologies is going to grow. 

Even with the Internet’s projected advancements, the future of crime and 
technology, like other trends, is difficult to precisely predict. John Nasibett, a renowned 
expert in the field of future studies, has stated, “Trends, like horses, are easier to ride in 
the direction they are going. ”202 xhis would mean that trends are not only difficult to 
predict, but easier to manage if they are known. A dynamic environment like the one 
created by crime and technology make predictability difficult individually, let alone when 
combined. Despite being difficult to predict, the one trend that appears certain is that 

299 Keith Breene, “What Is the Future of the Internet?” World Eeonomie Forum, aeeessed Oetober 11, 
2017, https://www.weforum.org/agenda/2016/01/what-is-the-future-of-the-Intemet/. 

200 Jim Sandle, “UN Thinks Internet Aeeess Is a Human Right,” Business Insider, July 22, 2016, 
http ://www.businessinsider.eom/un-says-Intemet-aeeess-is-a-human-right-2016-7; “Internet Users,” 

Internet Live Stats, aeeessed November 10, 2017, http://www.intemethvestats.eom/Intemet-users/. 

201 Goldstone, Jones, and Roberts, “Group Path Formation,” 612. 

202 p.W. Singer and Allan Friedman, Cybersecurity and Cyberwar: What Everyone Needs to Know, 
Kindle edition (New York: Oxford University Press, 2014), 247. 
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crime and law enforcement will continue to be shaped, influenced, and evolved by 
technology. 

As technology innovations continue to rapidly advance, so too will possibilities 
for the advancement of crimes facilitated by those technologies. As new technological 
innovations are designed, criminal typology will evolve, new categories of crime will 
emerge, old investigative techniques will become obsolete, and deviant behavior and 
criminal justice will continue to influence one another. The future holds more 
opportunities for hybrid crime to mature and change. Border-related crime, and all other 
crimes, will be facilitated by Internet technologies in the future. 

Future research should continue the effort of predicting how technologies will 
afford crime, working to analyze evolving crime, and distinguishing techniques that can 
deter hybrid and other categories of crime. It is difficult to conduct research on future 
unknowns, but perhaps future predictions about the border-related crime of smuggling 
can be used to help predict which technologies might facilitate crime. According to Peter 
Andres, “Anything that crosses a national border can be used for smuggling.”303 of even 
more importance, he states, “most smuggling parallels the methods and routes of legal 
commerce.”304 Perhaps the strategic technology trends for business could be used as a 
guide to predict possible technologies that might be used for crime. If that is the case, 
according to the Gartner business consulting firm, the current strategic technology trends 
include “artificial intelligence, intelligent apps and analytics, intelligent things, digital 
twins, cloud to the edge, conversational platforms, immersive experience, blockchain, 
event-driven model, and continuous adaptive risk and trust.”305 One or more of these 
technologies might hold the next affordance to disrupt crime, just as Tor and Bitcoin held 
the affordances that allowed Ulbricht to create the Silk Road. 

Darknet marketplaces are still an issue for future research. Even though the Silk 
Road, Silk Road 2.0, AlphaBay, Hansa, and many other darknet marketplaces have been 

303 Andreas, Border Games, 521. 

304 Ibid. 

305 “7op 10 Strategic Technology Trends for 2018,” Gartner, October 3, 2017, www.gartner.com/ 
doc/3811368?srcId=l-7251599992&cm_sp=swg-_-gi-_-dynamic. 
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seized by law enforcement, others remain active. As of the writing of this thesis, there are 
at least twelve darknet marketplaces, operating under the names The Majestic Garden, 
Valhalla, Dream Market, Russian SR, WayAway, Cannabis Growers and Merchants 
Cooperative, WallStreet Market, Sourcery, ZION, Berlusconi Market, Italian Deep Web, 
and HYDRA (Russian). 306 jor is still alive and well and affording anonymity to sustain 
these darknet marketplaces. While Tor is still an effective anonymizing software, others 
have emerged, including Tails, I2P, Freenet, Freepto, Subgraph OS, Whonix, Peerblock, 
Disconnect, and Tox.307 Future research could include analyzing these technologies and 
other tools used by darknet marketplaces. 

The goal of this thesis was to identify the challenges law enforcement faces when 
countering the illegal movement of people and goods facilitated by the Internet. While 
this research has provided several findings and prescriptive recommendations, it is just a 
small step into a complex topic. Further study is required to determine technologies that 
may one day afford crime, how affordance theory and other frameworks can uniquely 
advance criminal justice, and what new tools can help law enforcement battle upcoming 
challenges. There is a lot more work ahead. This study is just the tip of the iceberg. 


306 “DNStats - Online Darknet Market Index and Monitor,” aeeessed Oetober 12, 2017, 
https://www.bing.eom/er?IG=08AD2659BDEB487CAFC57CFC63EC7FC8&CID=19B85A3059A46B983 
119512958A26AC8&rd=l&h=_7oRGJjwig7o4_MukCaC2woGtBW0xvkKItp7TZNgWe0&v=l&r=https% 
3a%2P/o2fdnstats.net%2f&p=DevEx,5058.1. 

3^^ Adarsh Verma, “5 Best Alternatives to Tor Browser to Browse Anonymously,” Fossbytes. 
November 4, 2017, https://fossbytes.eom/best-altematives-to-tor-browser-to-browse-anonymously/; 
“Whonix vs Tails • r/TOR” Reddit, aeeessed November 19, 2017, www.reddit.eom/r/TOR/eomments/ 
40p3xy/whonix vs tails/; “PeerBlock Lets You Control Who Your Computer ‘Talks to’ on the Internet,” 
Download.eom, September 23, 2012, http://download.enet.eom/PeerBloek/3000-10435 4-75328692.html; 
“Disconnect,” accessed November 19, 2017, https://disconnect.me/; “A New Kind of Instant Messaging,” 
Project Tox, accessed November 19, 2017, https://tox.chat/. 
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